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Abstract 

In this paper, a Gaifman-Shapiro-style module architecture is tailored to the case of smod- 
els programs under the stable model semantics. The composition of smodels program 
modules is suitably limited by module conditions which ensure the compatibility of the 
module system with stable models. Hence the semantics of an entire smodels program 
depends directly on stable models assigned to its modules. This result is formalized as 
a module theorem which truly strengthens Lifschitz and Turner's splitting-set theorem 
(1994) for the class of smodels programs. To streamline generalizations in the future, the 
module theorem is first proved for normal programs and then extended to cover smod- 
els programs using a translation from the latter class of programs to the former class. 
Moreover, the respective notion of module-level equivalence, namely modular equivalence, 
is shown to be a proper congruence relation: it is preserved under substitutions of modules 
that are modularly equivalent. Principles for program decomposition are also addressed. 
The strongly connected components of the respective dependency graph can be exploited 
in order to extract a module structure when there is no explicit a priori knowledge about 
the modules of a program. The paper includes a practical demonstration of tools that have 
been developed for automated (de)composition of smodels programs. 

KEYWORDS: answer set programming, module system, compositional semantics, stable 
model semantics, modular equivalence 



1 Introduction 

Answer set programming (ASP) (Niemela 1999; Marek and Truszczyriski 1999; Gclfond and Leone 2002, 
Baral 2003) is an approach to declarative rule-based constraint programming that 
has been successively used in many knowledge representation and reasoning tasks 
(|Soininen et al. 2001| |Nogueira et al. 2001tlErdem et al. 2006tlBrooks et al. 2007)l . 
In ASP, the problem at hand is solved declaratively 



* This is an ex tended version of two conference papers ( Oikarinen and Janhunen 2006 
IQikarinen 200711 presented at ECAI'06 and LPNMR'07, respectively. 
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1. by writing down a logic program the answer sets of which correspond to the 
solutions of the problem and 

2. by computing the answer sets of the program using a special purpose search 
engine that has been designed for this task. 

A modelling philosophy of this kind suggests to treat programs as integral entities. 

The answer set semantics — originally defined for entire programs only (|Gelfond and Lifschitz 1 988; 

Gelfo nd and Lifschitz 19 90) — reflects also this fact. Such indivisibility of programs 

is creating an increasing problem as program instances tend to grow along the 

demands of new application areas of ASP. It is to be expected that prospective 

application areas such as semantic web, bioinformatics, and logical cryptanalysis 

will provide us with huge program instances to create, to solve, and to maintain. 

Modern programming languages provide means to exploit modularity in a num- 
ber of ways to govern the complexity of programs and their development process. 
Indeed, the use of program modules or objects of some kind can be viewed as an em- 
bodiment of the classical divide- and- conquer principle in the art of programming. 
The benefits of modular program development are numerous. A software system is 
much easier to design as a set of interacting components rather than a monolithic 
system with unclear internal structure. A modular design lends itself better for im- 
plementation as programming tasks are then easier to delegate amongst the team 
of programmers. It also enables the re-use of code organized as module libraries, 
for instance. To achieve similar advantages in ASP, one of the central goals of our 
research is to foster modularity in the context of ASP. 

Although modularity has been studied extensively in the context of conven- 
tional logic programs, see Bugliesi et al. (| 1994j) for a survey, relatively little at- 
tention has been paid to modularity in ASP. Many of the approaches proposed 
so far are based on very strict syntactic conditions on the module hierarchy, for 
instance, by enforcing stratification of some kind, or by prohibiting recursion alto- 
gether (jEiter et al. 1997trTarTet al. 2005|lEiter et al. 1997j) . On the other hand, ap- 
proaches based on splitting-sets (Lifschitz and Turner 1 994; Eit er et al. 1 997; Fab er et al. 2005) 
are satisfactory from the point of view of compositional semantics: the answer sets 
of an entire program are obtained as specific combinations of the answer sets of its 
components. A limitation of splitting-sets is that they divide logic programs in two 
parts, the top and the bottom, which is rather restrictive and conceptually very close 
to stratification. On the other hand, the compositionality of answer set semantics 
is neglected altogether in syntactic approaches Ijlanni et al. 2004} ITari et aT7 2005) 
and this aspect of models remains completely at the programmer's responsibility. 

To address the deficiencies described above, we accommodate a module archi- 
tecture proposed by Gaifman-Shapiro (JTjJ&O) to answer set programming, and in 
particular, in the context of the SMODELS system ((Simons et al. 2002p .FI There are 
two main criteria for the design. First of all, it is essential to establish the full com- 
positionality of answer set semantics with respect to the module system. This is to 



1 Also other systems such as clasp (Gebser e t al. 2007)l and cmodels (Lierler 2005} that are 
compatible with the internal file format of the smodels system are implicitly covered. 
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ensure that various reasoning tasks — such as the verification of program equivalence 
([Janhunen and Oikarinen 2007) — can be modularized. Second, for the sake of flexi- 
bility of knowledge representation, any restrictions on the module hierarchy should 
be avoided as far as possible. We pursue these goals according to the following plan. 

In Section [21 we take a closer look at modularity in the context of logic program- 
ming. In order to enable comparisons later on, we also describe related approaches in 
the area of ASP in more detail. The technical preliminaries of the paper begin with a 
recapitulation of stable model semantics (Gelfond and Lifschitz 1988)) in Section [31 
However, stable models, or answer sets, are reformulated for a class of programs 
that corresponds to the input language of the SMODELS solver ([Simons et al. 2002 ). 
The definition of splitting-sets is included to enable a detailed comparison with 
our results. Moreover, we introduce the concepts of program completion and loop 
formulas to be exploited in proofs later on, and review some notions of equivalence 
that have been proposed in the literature. 

In Section SI we present a module architecture for SMODELS programs, in which 
the interaction between modules takes place through a clearly defined input/output 
interface. The design superficially resembles that of Gaifman and Shapiro (1989) 
but in order to achieve the full compositionality of stable models, further condi- 
tions on program composition are incorporated. This is formalized as the main 
result of the paper, namely the module theorem, which goes beyond the splitting- 
set theorem ([Lifschitz and Turner 1994]) as negative recursion is tolerated by our 
definitions. The proof is first presented for normal programs and then extended 
for SMODELS programs using a translation-based scheme. The scheme is based on 
three distinguished properties of translations, strong faithfulness, preservation of 
compositions, and modularity, that are sufficient to lift the module theorem. In this 
way, we get prepared for even further syntactic extensions of the module theorem 
in the future. The respective notion of module-level equivalence, that is, modular 
equivalence, is proved to be a proper congruence for program composition. In other 
words, substitutions of modularly equivalent modules preserve modular equivalence. 
This way modular equivalence can be viewed as a reasonable compromise between 
uniform equivalence (|Eiter and Fink 2003|) which is not a congruence for program 
union, and strong equivalence (Lifs chitz et al. 2001[) which is a congruence for pro- 
gram union but allows only rather straightforward semantics-preserving transfor- 
mations of (sets of) rules. 

In Section [H we address principles for the decomposition of SMODELS programs. 
It turns out that strongly connected components of dependency graphs can be 
exploited in order to extract a module structure when there is no explicit a priori 
knowledge about the modules of a program. In addition, we consider the possibility 
of relaxing our restrictions on program composition using the content of the module 
theorem as a criterion. The result is that the notion of modular equivalence remains 
unchanged but the computational cost of checking legal compositions of modules 
becomes essentially higher. In Section El we demonstrate how the module system 
can be exploited in practise in the context of the SMODELS system. We present 
tools that have been developed for (de) composition of logic programs and conduct a 
practical experiment which illustrates the performance of the tools when processing 
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very large benchmark instances, that is, SMODELS programs having up to millions 
of rules. The concluding remarks of this paper are presented in Section [3 

2 Modularity aspects of logic programming 

Bugliesi et al. i 19!) 1) address several properties that are expected from a modular 
logic programming language. For instance, a modular language should 

• allow abstraction, parameterization, and information hiding, 

• ease program development and maintenance of large programs, 

• allow re-usability, 

• have a non-trivial notion of program equivalence to justify replacement of 
program components, and 

• maintain the declarativity of logic programming. 

Two mainstream programming disciplines are identified. In programming-in-the- 
large approaches programs are composed with algebraic operators, see for instance 
(jO'Keefe 1985tlMancarella and Pedreschi 1988t|Gaifman and Shapiro 1989HBrogi et al. 1994| ). 
In programming-in-the- small approaches abstraction mechanisms are used, see for 
instance IjMiller 1989| IGiordano and Martelli 1994[) . 

The programming-in-the-large approaches have their roots in the framework pro- 
posed by O'Keefe (1985) where logic programs are seen as elements of an algebra 
and the operators for composing programs are seen as operators in that algebra. The 
fundamental idea is that a logic program should be understood as a part of a sys- 
tem of programs. Program composition is a powerful tool for structuring programs 
without any need to extend the underlying language of Horn clauses. Several al- 
gebraic operations such as union, deletion, overriding union and closure have been 
considered. This approach supports naturally the re-use of the pieces of programs 
in different composite programs, and when combined with an adequate equivalence 
relation also the replacement of equivalent components. This approach is highly 
flexible, as new composition mechanisms can be obtained by introducing a corre- 
sponding operator in the algebra or combining existing ones. Encapsulation and 
information hiding can be obtained by introducing suitable interfaces for compo- 
nents. 

The programming-in-the- small approaches originate from IjMiller 1989|) . In this 
approach the composition of modules is modelled in terms of logical connectives 
of a language that is defined as an extension of Horn clause logic. The approach 
in IjGiordano and Martelli 1994j) employs the same structural properties, but sug- 
gests a more refined way of modelling visibility rules than the one in (Miller 1989). 

It is essential that a semantical characterization of a modular language is such 
that the meaning of composite programs can be defined in terms of the meaning of 
its components (IMaher 1993|l . To be able to identify when it is safe to substitute 
a module with another without affecting the global behavior it is crucial to have 
a notion of semantical equivalence. More formally these desired properties can be de- 
scribed under the terms of compositionality and full abstraction (Gaifman and Shap iro 1989; 
|Meyer 1988"] ). 
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Two programs are observationally congruent, if and only if they exhibit the same 
observational behavior in every context they can be placed in. A semantics is compo- 
sitional if semantical equality implies observational congruence, and fully abstract 
if semantical equivalence coincides with observational congruence. The composi- 
tionality and full abstraction properties for different notions of semantical equiv- 
alence (subsumption equivalence, logical equivalence, and minimal Herbrand model 
lence) and different operators in an algebra (union, closure, overriding union) 



are considered in fBugliesi et al. 1994 ). It is worth noting that minimal Herbrand 
model equivalence coincides with the weak equivalence relation for positive logic 
programs. As to be defined in Section 13.31 two logic programs are weakly equiv- 
alent if and only if they have exactly the same answer sets. As the equivalence 
based on minimal Herbrand model semantics is not compositional with respect to 
program union ( Bugliesi et al. 199 4), we note that it is not a suitable composition 
operator for our purposes unless further constraints are introduced. 



2.1 Modularity in answer set programming 

There are a number of approaches within answer set programming involving mod- 
ularity in some sense, but only a few of them really describe a flexible module 
architecture with a clearly defined interface for module interaction. 

Eiter, Gottlob, and Veith ([1997]) address modularity in ASP in the programming- 
in-the-small sense. They view program modules as generalized quantifiers as intro- 
duced in (Mostowski 1957J). The definitions of quantifiers are allowed to nest, that 
is, program P can refer to another module Q by using it as a generalized quantifier. 
The main program is clearly distinguished from subprograms, and it is possible to 
nest calls to submodules if the so-called call graph is hierarchical, that is, acyclic. 
Nesting, however, increases the computational complexity depending on the depth 
of nesting. 

Ianni et al. (|2004p propose another programming-in-the-small approach to ASP 
based on templates. The semantics of programs containing template atoms is de- 
termined by an explosion algorithm, which basically replaces the template with 
a standard logic program. However, the explosion algorithm is not guaranteed to 
terminate if template definitions are used recursively. 

Tari et al. I|2005|l extend the language of normal logic programs by introducing 
the concept of import rules for their ASP program modules. There are three types 
of import rules which are used to import a set of tuples X for a predicate q from 
another module. An ASP module is defined as a quadruple of a module name, a 
set of parameters, a collection of normal rules and a collection of import rules. 
Semantics is only defined for modular programs with acyclic dependency graph, 
and answer sets of a module are defined with respect to the modular ASP program 
containing it. Also, it is required that import rules referring to the same module 
always have the same form. 

Programming-in-the-large approaches in ASP are mostly based on Lifschitz and 
Turner's splitting-set theorem IjLifschitz and Turner 1994|) or are variants of it. The 
class of logic programs considered in (Lif schitz and Turner 1994 1 is that of extended 
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disjunctive logic programs, that is, disjunctive logic programs with two kinds of 
negation. A component structure induced by a splitting sequence, that is, iterated 
splittings of a program, allows a bottom-up computation of answer sets. The restric- 
tion implied by this construction is that the dependency graph of the component 
chain needs to be acyclic. 

Eiter, Gottlob, and Mannila (| 1997|) consider disjunctive logic programs as a query 
language for relational databases. A query program n is instantiated with respect 
to an input database D confined by an input schema R. The semantics of ir de- 
termines, for example, the answer sets of ir[D] which are projected with respect 
to an output schema S. Their module architecture is based on both positive and 
negative dependencies and no recursion between modules is tolerated. These con- 
straints enable a straightforward generalization of the splitting-set theorem for the 
architecture. 

Faber et al. (2005) apply the magic set method in the evaluation of Datalog 
programs with negation, that is, effectively normal logic programs. This involves 
the concept of an independent set S of a program P which is a specialization of 
a splitting set. Due to a close relationship with splitting sets, the flexibility of 
independent sets for parceling programs is limited in the same way. 

The approach based on Ip-functions (Gelfon d and Gabaldon 19 99; Baral 20031 is 
another programming-in-the-large approach. An lp-function has an interface based 
on input and output signatures. Several operations, for instance incremental exten- 
sion, interpolation, input opening, and input extension, are introduced for compos- 
ing and refining lp-functions. The composition of lp-functions, however, only allows 
incremental extension, and thus similarly to the splitting-set theorem there can be 
no recursion between lp-functions. 

3 Preliminaries: SMODELS programs 

To keep the presentation of our module architecture compatible with an actual 
implementation, we cover the input language of the SMODELS system — excluding 
optimization statements. In this section we introduce the syntax and semantics for 
SMODELS programs, and, in addition, point out a number of useful properties of 
logic programs under stable model semantics. We end this section with a review of 
equivalence relations that have been proposed for logic programs. 

3.1 Syntax and semantics 

Basic constraint rules (|Simons et al. 2002)) are either weight rules of the form 

a <— w < {bi = , ■ ■ ■ ,b n — Wb n , ~ci = w Cl , . . . ,~c TO = w Cm } (1) 

or choice rules of the form 

{oi, . . . ,cih} <— bi, . . . ,b n , ~ci, . . . ,~c m (2) 

where a, Oj's, fr/s, and c& ! s are atoms, h > 0, n > 0, m > 0, and ~ denotes negation 
as failure or default negation. In addition, a weight rule ([l]) involves a weight limit 
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ice! and the respective weights Wj,. € N and w Ck £ N associated with each positive 
literal bj and negative literal ^c^. We use a shorthand = {^a | a e A} for any 
set of atoms A. Each basic constraint rule r consists of two parts: a or {<zi, . . . ,dh} is 
the ftearf of the rule, denoted by Head(r), whereas the rest is called its body. The set 
of atoms appearing in a body of a rule can be further divided into the set of positive 
body atoms, defined as Body + (r) = {b\, . . . , b n }, and the set of negative body atoms, 
defined as Body~(r) = {c\, . . . ,c m }. We denote by Body(r) = Body + (r) U Body ~(r) 
the set of atoms appearing in the body of a rule r. Roughly speaking, the body 
gives the conditions on which the head of the rule must be satisfied. For example, 
in case of a choice rule (J2j) , this means that any head atom a; can be inferred to 
be true if 61, . . . ,b n hold true by some other rules but none of the atoms c\, . . . ,c m - 
Weight rules of the form ([J) cover many other kinds of rules of interest as their 
special cases: 



Cardinality rules of the form ([3]) are essentially weight rules (HJ where w = I and 
all weights associated with literals equal to 1. A normal rule, or alternatively a 
basic rule ((4]) is a special case of a cardinality rule with I = n + m. The in- 
tuitive meaning of an integrity constraint © is that the conditions given in the 
body are never simultaneously satisfied. The same can be stated in terms of a basic 
rule / <— 61, . . . ,b n , ~ci, . . . ,~c m , ~/ where / is a new atom dedicated to integrity 
constraints. Finally, compute statements {6]) of the SMODELS system effectively cor- 
respond to sets of integrity constraints «— ...,«— ~b n and <— ci, ...,<— c m . 

Because the order of literals in (TJ and ^ is considered irrelevant, we introduce 
shorthands A = {a\, . . . , ah}, B = {b\, . . . , b n }, and C = {ci, . . . , c m } for the sets 
of atoms involved in rules, and Wb = {w^, ■ ■ ■ ,Wb n } and Wc — {w Cl , ■ ■ ■ , w Cm } 
for the respective sets of weights in (TJ). Using these notations ((TJ) and ^ are 
abbreviated by a <- to < {B = W B , ~C = Wcjfl and {A} <- B, ~C. 

In the SMODELS system, the internal representation of programs is based on rules 
of the forms ©-(HI) and ([6]) and one may conclude that basic constraint rules, as 
introduced above, provide a reasonable coverage of SMODELS programs. Thus we 
concentrate on rules of the forms |T]) and ([2]) and view others as syntactic sugar in 
the sequel. 

Definition 3.1 An SMODELS program P is a finite set of basic constraint rules. 

An SMODELS program consisting only of basic rules is called a normal logic pro- 
gram (NLP), and a basic rule with an empty body is called a fact. Given an SMODELS 



a <— I < {h, ■ ■ ■ ,b n , ~ci, . . . ,~c m } 
ot < b\, . . . ,b n , ~Cx, . . . ,~c m 
< b\, . . . ,b n , ~ci, . . . ,~c m 
compute {61, . . . ,&„, ~c x , . . . ,~c m } 



(3) 
(4) 

(5) 
(6) 



2 Strictly speaking B = Wb and ~C = Wc are to be understood as sets of pairs of the form 
(6, ui;,) and (~c, w c ), respectively. For convenience the exact matching between literals and 
weights is left implicit in the shorthand. 
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program P, we write At(P) for its signature, that is, the set of atoms occurring in P, 
and Body(P) and Hcad(P) for the respective subsets of At(P) having body occur- 
rences and head occurrences in the rules of P. Furthermore, Choices(P) C Head(P) 
denotes the set of atoms having a head occurrence in a choice rule of P. 

Given a program P, an interpretation M of P is a subset of At(P) defining which 
atoms a S At(P) are true (a £ M) and which are false (a $ M). A weight rule (Q]) 
is satisfied in M if and only if a £ M whenever the sum of weights 

beBnM cGC\M 

is at least w. A choice rule {A} <— B. is always satisfied in M. An interpretation 
M C At(P) is a (classical) model of P, denoted by M \= P, if and only if M satisfies 
all the rules in P. 

The generalization of the Gelfond-Lifschitz reduct (Gel fond and Lifschitz 1 988) 
for SMODELS programs is defined as follows. 

Definition 3.2 For an SMODELS program P and an interpretation M C At(P), 
the reduct P M contains 

1. a rule a «— B if and only if there is a choice rule {A} <— B,^C in P such that 
a e An M, and MCiC = 0; 

2. a rule a <— w' < {B = Wb} if and only if there is a weight rule a <— w < 
{B = Wb, ~C" = Wc} in P such that w' — max(0, w — J2 c ec\M Wc )- 

We say that an SMODELS program P is positive if each rule in P is a weight rule 
restricted to the case C = 0, Recalling that the basic rules are just a special case 
of weight rules, we note that the reduct P M is always positive. An interpretation 
M C At(P) is the least model of a positive SMODELS program P, denoted by LM(P), 
if and only if M \= P and there is no M' |= P such that M' C M. Given the 
least model semantics for positive programs l| Janhunen and Oikarinen 2007|l . the 
stable model semantics (Gelfo nd" and Lifschitz 1988| straightforwardly generalizes 
for SMODELS programs IjSimons et al. 2002p . 

Definition 3.3 An interpretation M C At(P) is a stable model of an SMODELS 
program P if and only if M — LM(P M ). 

Given an SMODELS program P and a,b € At(P), we say that a depends directly 
on b, denoted by b <i a, if and only if P contains a rule r such that a € Head(r) 
and b 6 Body + (r). The positive dependency graph of P, denoted by Dep + (P), is 
the graph (At(P), <i). The reflexive and transitive closure of <i gives rise to the 
dependency relation < over At(P). A strongly connected component (SCC) S of 
Dep + (P) is a maximal set S C At(P) such that b < a holds for every a,b E S. 

3.2 Splitting sets and loop formulas 

In this section we consider only the class of normal logic programs. We formu- 
late the splitting-set theorem IjLifschitz and Turner 1994] ) in the case of normal 



Theory and Practice of Logic Programming 



9 



logic programqj, and give an alternative definition of stable models based on the 
classical models of the completion of a program i Clark 1978[) and its loop formu- 
las (|Lin and Zh ao 2004). The splitting-set theorem can be used to simplify the 
computation of stable models by splitting a program into parts, and it is also a 
useful tool for structuring mathematical proofs for properties of logic programs. 

Definition 3.4 A splitting set for a normal logic program P is any set U C At(P) 
such that for every rule r in P it holds that At(r) C U i/Head(r) £ U. 

The set of rules r £ P such that At(r) C U is the bottom of P relative to U, 
denoted by bj/(P). The set tj/(P) = P \ ^>u{P) is the top of P relative to U which 
can be partially evaluated with respect to an interpretation X C U. The result is 
a program e(tj/(P), X) defined as 

{Head(r) <- (Body+(r) \ U), ~(Body~(r) \ U) \ r £ t v (P), 

Body + (r) nC/CIand (Body"(r) n U) n X = 0}. 

A solution to a program with respect to a splitting set is a pair consisting of a stable 
model X for the bottom and a stable model Y for the top partially evaluated with 
respect to X. 

Definition 3.5 Given a splitting set U for a normal logic program P, a solution 
to P with respect to U is a pair (X, Y) such that 

(i) X CU is a stable model ofbjj(P), and 
(ii) Y C At(P) \U is a stable model of e(tj/(P), X). 

Solutions and stable models relate as follows. 

Theorem 3.6 (The splitting-set theorem (Lifschi tz and Turner 1 994)) 

Let U be a splitting set for a normal logic program P and M C At(P) an interpre- 
tation. Then M £ SM(P) if and only if the pair (M (1 U , M \ U) is a solution to P 
with respect to U . 

The splitting-set theorem can also be used in an iterative manner, if there is a 
monotone sequence of splitting sets {U\, . . . , Ui, . . .}, that is, [/, C Uj if i < j, 
for program P. This is called a splitting sequence and it induces a component 
structure for P. The splitting-set theorem generalizes to a splitting sequence theo- 
rem ([Lifschitz and Turner 1994|) . and given a splitting sequence, the stable models 
of a program P can be computed iteratively bottom-up. 

Lin and Zhao present an alternative definition of stable models for normal logic 
programs based on the classical models of the completion of a program ( Clar k 1978j) 
and its loop formulas (|Lin and Zhao 2004j) . We will apply this definition later on in 
the proof of the module theorem (Theorem 14. 14[) . 



3 Lifschitz and Turner (|1994|) consider a more general class of logic programs, extended disjunctive 
logic programs, that is, disjunctive logic programs with two kinds of negation. 
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Definition 3.7 (Program completion (jClark 1978|:|Fages 1994[ )) The com- 
pletion of a normal logic program P is 

Comp(P) = f\ \/ ( A 6A A - C JJ- ( ? ) 

oeAt(P) V Hcad(r)=a V 6eBody+(r) ceBody~(r) / / 

Note that an empty body reduces to true and in that case the respective equivalence 
for an atom a is logically equivalent to a «-» T. 

Definition 3.8 Given a normal logic program P. a set of atoms L C At(P) is a 
loop of P if for every a,b e L there is a path of non-zero length from a to b in 
Dep + (P) such that all vertices in the path are in L. 

Definition 3.9 Given a normal logic program P and a loop L C At(P) of P, the 
loop formula associated with L is 

lf(l,p) = J V ( A 6A A - c ))^A- a 

\reEB(L,P) \6eBody+(r) ceBody-(r) / / aEL 

where EB(L, P) = {r e P \ Head(r) £ L and Body + (r) n L = 0} is the set of rules 
in P which have external bodies of L. 

Now, stable models of a program and classical models of its completion that 
satisfy the loop formulas relate as follows. 

Theorem 3.10 ( (jLin and Zhao 2004j) ) Given a normal logic program P and an 
interpretation M C At(P), M G SM(P) if and only if M \= Comp(P) U LF(P), 
where LF(P) is the set of all loop formulas associated with the loops of P. 



3.3 Equivalence relations for smodels programs 

There are several notions of equivalence that have been proposed for logic programs. 
We review a number of them in the context of SMODELS programs. 

Lifschitz et al. (|200ip address the notions of weak/ordinary equivalence and strong 
equivalence. 

Definition 3.11 smodels programs P and Q are weakly equivalent, denoted by 
P = Q, if and only ifSM(P) = SM(Q); and strongly equivalent, denoted by P = s Q, 
if and only if P U R= Q U R for any SMODELS program R. 

The program R in the above definition can be understood as an arbitrary context 
in which the two programs being compared could be placed. Therefore strongly 
equivalent logic programs are semantics preserving substitutes of each other and 
relation = s is a congruence relation for U among smodels programs, that is, if 
P = s Q, then also P U R = s Q U R for all smodels programs R. Using R = 
as context, one sees that P = s Q implies P = Q. The converse does not hold in 
general. 
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A way to weaken strong equivalence is to restrict possible contexts to sets of 
facts. The notion of uniform equivalence has its roots in the database community 
flSagiv 1987[ ), see (jEiter and Fink 2003|) for the case of the stable model semantics. 

Definition 3.12 SMODELS programs P and Q are uniformly equivalent, denoted 
by P = u Q, if and only if P U F = Q U F for any set of facts F. 

Example 13.131 shows that uniform equivalence is not a congruence for union. 

Example 3.13 ((Eit er" et al. 20041 Example 1)) Consider programs P = {a.} 

and Q = {a < b. a <- b.}. It holds that P = u Q, but P U R ^ Q U R for the 

context R = {b «— a.}. This implies P ^ s Q and PUR ^ u Q U R. ■ 

There are also relativized variants of strong and uniform equivalence IjWoltran 2004|) 
which allow the context to be constrained using a set of atoms A. 

For weak equivalence of programs P and Q to hold, SM(P) and SM(Q) have 
to be identical subsets of 2 At ' p ) and 2 At ^, respectively. The same effect can be 
seen with P = s Q and P = u Q. This makes these relations less useful if At(P) 
and At(Q) differ by some (local) atoms not trivially false in all stable models. The 
visible equivalence relation J Ja nhunen 2006|1 takes the interfaces of programs into 
account. The atoms in At(P) are partitioned into two parts, At v (P) and Ath(P), 
which determine the visible and the hidden parts of At(P), respectively. Visible 
atoms form an interface for interaction between programs, and hidden atoms are 
local to each program and thus negligible when visible equivalence of programs is 
concerned. 

Definition 3.14 SMODELS programs P and Q are visibly equivalent, denoted by 
P = v Q, if and only j/At v (P) = At v (Q) and there is a bisection f : SM(P) — » 
SM(Q) such that for all M e SM(P), M n At v (P) = f(M) n At v (Q). 

Note that the number of stable models is also preserved under = v . Such a strict 
correspondence of models is much dictated by the answer set programming method- 
ology: the stable models of a program usually correspond to the solutions of the 
problem being solved and thus the exact preservation of models is highly signifi- 
cant. In the fully visible case, that is, for Ath(P) = Ath(Q) = 0, the relation = v 
becomes very close to =. The only difference is the requirement that At(P) = At(Q) 
insisted on = v . This is of little importance as At(P) can always be extended by 
adding (tautological) rules of the form a <— a to P without affecting the stable 
models of the program. Since weak equivalence is not a congruence for U, visible 
equivalence cannot be a congruence for program union either. 

The verification of weak, strong, or uniform equivalence is a coNP-complete deci- 
sion problem for SMODELS programs | [Marek and Truszczyhski 1991|IPearce et al. 2001; 
lEiter and~ Fink 2003). The computational complexity of deciding = v is analyzed 
in (|Janhunen and Oikarinen 2007|l . If the use of hidden atoms is not limited in any 
way, the problem of verifying visible equivalence becomes at least as hard as the 
counting problem #SAT which is #P-complete (Vali ant 1979|l . It is possible, how- 
ever, to govern the computational complexity by limiting the use of hidden atoms 
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by the property of having enough visible atoms ([Janhunen and Oikarinen 2007|) . In- 
tuitively, if P has enough visible atoms, the EVA property for short, then each inter- 
pretation of At v (P) uniquely determines an interpretation of Ath (P) . Consequently, 
the stable models of P can be distinguished on the basis of their visible parts. Al- 
though verifying the EVA property can be hard in general ([Janhunen and O ikarine n 2007| 
Proposition 4.14), there are syntactic subclasses of SMODELS programs with the 
EVA property. The use of visible atoms remains unlimited and thus the full expres- 
siveness of SMODELS programs remains at programmer's disposal. Also note that 
the EVA property can always be achieved by declaring sufficiently many atoms 
visible. For SMODELS programs with the EVA property, the verification of visible 
equivalence is a coNP-complete decision problem (| Janhunen and Oikarinen 2007). 

Eiter et al. (|2005[) introduce a very general framework based on equivalence frames 
to capture various kinds of equivalence relations. All the equivalence relations de- 
fined in this section can be defined using the framework. Visible equivalence, how- 
ever, is exceptional in the sense that it does not fit into equivalence frames based 
on projected answer sets. As a consequence, the number of answer sets may not be 
preserved which is somewhat unsatisfactory because of the general nature of answer 
set programming as discussed in the previous section. Under the EVA assumption, 
however, the projective variant of visible equivalence defined by 

{M n At v (P) | M G SM(P)} = {N n At v (Q) | N e SM(Q)} 

coincides with visible equivalence. 

Recently Woltran presented another general framework characterizing (H,B)- 
equivalence ( Wol tran 2007p . (H, £>}-equivalence is defined similarly to strong equiv- 
alence, but the set of possible contexts is restricted by limiting the head and body 
occurrences of atoms in a context program R by H and B, respectively. Thus, pro- 
grams P and Q are (H, £>) -equivalent if and only if P U R = Q U R for all R such 
that Head(P) C H and Body(P) C B. Several notions of equivalence such as weak 
equivalence together with (relativized) strong and (relativized) uniform equivalence 
can be seen as special cases of (TC, 2?}-equivalence by varying the sets H and B. 



4 SMODELS program modules 

We start this section by introducing the syntax and the stable model semantics 
for an individual SMODELS program module, and then formalize the conditions for 
module composition. One of the main results is the module theorem showing that 
module composition is suitably restricted so that compositionality of stable model 
semantics for SMODELS programs is achieved. We also introduce an equivalence re- 
lation for modules, and propose a general translation-based scheme for introducing 
syntactical extensions for the module theorem. The scheme is then utilized in the 
proof of the module theorem. We end this section with a brief comparison between 
our module architecture and other similar proposals. 
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4-1 Syntax and semantics of an SMODELS program module 

We define a logic program module similarly to Gaifman and Shapiro (|1989|). but 
consider the case of SMODELS programs instead of positive normal logic programs 
covered in ( [Gaifman and Shapiro 1989] ). An analogous module system in the con- 
text of disjunctive logic programs is presented in fJ anhunen et al, 2 007), 



Definition 4.1 An SMODELS program module ¥ is a quadruple (R, 1 ,0, H) where 

1. R is a finite set of basic constraint rules; 

2. /, O, and H are pairwise disjoint sets of input, output, and hidden atoms; 

3. At(R) C At(P) which is defined by At(P) = / U O U H; and 

4. Head(i?) HI = 0. 

The atoms in At v (P) — I DO are considered to be visible and hence accessible 
to other modules conjoined with P; either to produce input for P or to utilize the 
output of P. We use notations At; (P) and At (P) for referring to the input signature 
I and the output signature O, respectively. The hidden atoms in Ath(P) = H = 
At(P) \ At v (P) are used to formalize some auxiliary concepts of P which may not 
be sensible for other modules but may save space substantially. The use of hidden 
atoms may yield exponential savings in space, see (|Janhunen and Oikarinen 2007, 
Example 4.5), for instance. The condition Head(i?) PI I = ensures that a module 
may not interfere with its own input by defining input atoms of / in terms of its 
rules. Thus input atoms are only allowed to appear as conditions in rule bodies. 



Example 4.2 Consider the Hamiltonian cycle problem for directed graphs, that is, 
whether there is a cycle in the graph such that each node is visited exactly once 
returning to the starting node. 

Let n denote the number of nodes in the graph and let arc(x, y) denote that there 
is a directed edge from node x to node y in the graph. 

Module H n = (i?, /, O, {c, d}) selects the edges to be taken into a cycle by insisting 
that each node must have exactly one incoming and exactly one outgoing edge. The 
input signature of H™ is a graph represented as a set of edges: I = {arc(x,y) \ 
1 < x,y < n}. The output signature ofW 1 represents which edges get selected into 
a candidate for a Hamiltonian cycle: O = {hc(x,y) \ 1 < x, y < n}. The set R 
contains rules 

{bc(x,y)} <- arc(x,y) (8) 
c <- 2 < {hc(a;, l),...,hc(x,n)} (9) 
c <— ~hc(a;, 1), . . . ,~hc(a^,n) (10) 
c <— 2 < {hc(l,a;), . . . , hc(n, x)} and (11) 
c <— ~hc(l,a;), . . . , ~hc(n, x) (12) 

for each 1 < x,y < n; and a rule d *— ~<i, c which enforces c to be false in every 
stable model. The rules in (E) encode the selection of edges taken in the cycle. The 
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rules in ^) and I110\) are used to guarantee that each node has exactly one outgo- 
ing edge, and the rules in 1 11)) and (12)) give the respective condition concerning 
incoming edges. 

We also need to check that each node is reachable from the first node along the 
edges in the cycle. For this, we introduce module M™ = (R 1 , 1', O', {e}). The input 
signature ofW 1 is I' = O, and the output signature is O' = {reached(x) 1 < x < 
n}, where reached (x) tells that node x is reachable from the first node. The set R' 
contains rules 

reached(y) <— hc(l,y) 
reached(y) <— reached(a;), hc(x, y) 
e <— ~e, ^reached(y) 

for each 2 < x < n and 1 < y < n. ■ 

To generalize the stable model semantics to cover modules as well, we must 
explicate the semantical role of input atoms. To this end, we will follow an ap- 
proach from (|Janhunen et al. 2007|1 and take input atoms into account in the 
definition of the reduct adopted from (1 Janhunen and Oikarinen 2Q07[) . It should 
be stressed that all negative literals and literals involving input atoms get evalu- 
ated in the reduction. Moreover, our definitions become equivalent with those pro- 
posed for normal programs (Gelfo nd and Lifschitz 1988| and SMODELS programs 
(jjanhunen and Oikarinen 2007|) if an empty input signature I = is additionally 
assumed. Using the same idea, a conventional SMODELS program, that is, a set of 
basic constraint rules R, can be viewed as a module (R, 0, At(i?), 0) without any 
input atoms and all atoms visible. 

Definition 4.3 Given a module P = (R,I,0,H), the reduct of R with respect to 
an interpretation M C At(P) and input signature I, denoted by R A1,1 , contains 

1. a rule a «— (B\I) if and only if there is a choice rule {A} *— B, ~C in R such that 
aeAilM, Bill CM, and M DC = 0; and 

2. a rule a <— w' < {B \ I = Wgu} if and only if there is a weight rule a <— w < 
{B = W B , ~C = W c } in R, and 

w' = max(0, w — wi, — w c ). 

beBninM cec\M 

As all occurrences of atoms in the input signature and all negative occurrences of 
atoms are evaluated, the generalized reduct R M,! is a positive program in the sense 
of l|Janhunen an d Oikarinen 2007) and thus it has a unique least model LM(R ,J ) C 
At(R) \ I. 



4 There are alternative ways to handle input atoms. One poss ibility is to combine a module 
with a set of f acts (or a database) over its input signature (Oikarinen and Janhunen 2006 
Oikarinen 2007). Yet anoth er approach is to interpret input atoms as fixed atoms in the sense 
of parallel circumscription lILifschitz 1 985 ). 
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Definition 4.4 An interpretation M C At(P) is a stable model of an SMODELS 
program module P = (R, I, O, H) , denoted by M £ SM(P), if and only if M \ I = 
LM(i? M < 7 ). 

If one is interested in computing stable models of a module with respect to a 
certain input interpretation, it is easier to use an alternative definition of stable 
semantics for modules (Oikarin en and Janhunen 2006[) . where an actual input is 
seen as a set of facts (or a database) to be combined with the module. 

Definition 4.5 Given an SMODELS program module P = (R,I,0,H) and a set of 
atoms AC/, the instantiation of P with an actual input A is 

¥(A) = (R U {a. | a 6 A}, 0, JU O, H). 

The module V(A) is essentially an SMODELS program with JUOas the set of visible 
atoms. Thus the stable model semantics of SMODELS programs in Definition 13.31 
directly generalizes for an instantiated module. 

Definition 4.6 An interpretation M C At(P) is a stable model of an SMODELS 
program module P = (R, I, O, H) if and only if M = LM(R M U {a. \ a G M n I}). 

It is worth emphasizing that Definitions 14.41 and 14.61 result in exactly the same 
semantics for SMODELS program modules. 

Example 4.7 Recall module H™ from Example \4-2[ We consider the stable models 
of H™ for n = 2 to see that the rules in H™ do not alone guarantee that each 
node is reachable along the edges taken in the cycle candidate. Consider M = 
{arc(l,l),arc(2,2),hc(l,l),hc(2,2)}. The reduct R MJ contains facts hc(l, 1) and 
hc(2,2); and rules c <- 2 < {hc(l, 1), hc(l, 2)} ; c <- 2 < {hc(2, 1), hc(2, 2)}, 
c <- 2 < {hc(l, 1), hc(2, 1)}, and c <- 2 < {hc(l, 2), hc(2, 2)}; and /ina% £/ie raZe 
d <- c. Now M e SM(H") since M = LM(R MJ ). However, M does not correspond 
to a graph with a Hamiltonian cycle, as node 2 is not reachable from node 1. ■ 

4-2 Composing programs from modules 

The stable model semantics ([Gelfond and Lif schitz 1988) does not lend itself di- 
rectly for program composition. The problem is that in general, stable models asso- 
ciated with modules do not determine stable models assigned to their composition. 

Gaifman and Shapiro (I1989P cover positive normal programs under logical con- 
sequences. For their purposes, it is sufficient to assume that whenever two mod- 
ules Pi and P2 are put together, their output signatures have to be disjoint and 
they have to respect each other's hidden atoms, that is, Ath(Pi) PI At(P2) = and 
At h (P 2 ) n At (Pi) - 0. 

Definition 4.8 Given SMODELS program modules Pi = (Ri,Ii,Oi,Hx) andY 2 = 
(R2, h, O2, H2), their composition is 

Pi © P 2 = (Ri U R 2 , (h \ O2) U (/ a \ Ox), Ox U 2 ,H X U H 2 ) 
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j/At (Pi) n At D (P2) = and Pi and P2 respect each other's hidden atoms. 

The following example shows that the conditions given for © are not enough to 
guarantee compositionality in the case of stable models and further restrictions on 
program composition become necessary. 

Example 4.9 Consider normal logic program modules Pi = ({a <— fo.}, {6}, {a}, 0) 
and P2 = ({b <— a.}, {a}, {6}, 0) both of which have stable models and {a, b} by 
symmetry. The composition 0/P1 and P2 is Pi ©P 2 = ({a <— b. b <— a.}, 0, {a, b}, 0) 
arad SM(Pi © P 2 ) = {0}, that is, {a, b} is not a stable model 0/P1 © P 2 . ■ 

We define the positive dependency graph of an SMODELS program module P = 
(R, I, O, H) as Dep+(P) = Dcp+(i?). Given that Pi © P 2 is defined, we say that Pi 
and P2 are mutually dependent if and only if Dep + (Pi © P2) has an SCC S such 
that S n Ato(Pi) ^ and S n At (P 2 ) ^ 0, that is, S is shared by Pi and P 2 . 

Definition 4.10 The join Pi U P 2 of two SMODELS program modules Pi and P2 is 
Pi © Pa, provided Pi © P2 is defined and Pi and P2 are not mutually dependent. 

Example 4.11 Consider modules H™ and M. n from Example \4-2\ Since H n and 
M. n respect each other's hidden atoms and are not mutually dependent, their join 
U n U R" = (R U R', I, O U O', {c, d, e}) is defined. ■ 

The conditions in Definition 14. lOl impose no restrictions on positive dependencies 
inside modules or on negative dependencies in general. It is straightforward to show 
that U has the following properties: 

(i) Identity: P U (0, 0, 0, 0) = (0, 0, 0, 0) U P = P for all modules P. 

(ii) Commutativity: Pi UP 2 = P 2 UPi for all modules Pi and P 2 such that Pi UP 2 
is defined. 

(iii) Associativity: (Pi U P 2 ) U P 3 = Pi U (P 2 U P 3 ) for all modules Pi,P 2 and P 3 
such that all pairwise joins are defined. 

The equality "=" used above denotes syntactical equality. Also note that P U P is 
usually undefined, which is a difference with respect to U for which it holds that 
PUP = P for all programs P. Furthermore, considering the join Pi UP2, since each 
atom is defined in exactly one module, the sets of rules in Pi and P2 are distinct, 
that is, Rx n R 2 = 0, and also, At (Pi U P 2 ) = At (Pi) U At(P 2 ), At v (Pi U P 2 ) = 
At v (Pi) U At v (P 2 ), and At h (Pi U P 2 ) = At h (Pi) U At h (P 2 ). 

Having the semantics of an individual SMODELS program module now defined, we 
may characterize the properties of the semantics under program composition using 
the notion of compatibility. 

Definition 4.12 Given SMODELS program modules Pi and P 2 such £/ia£ Pi ©P 2 is 
defined, we say that interpretations M\ C At (Pi) and M2 C At(P 2 ) are compatible 
if and only if M l f) At v (P 2 ) = M 2 n At v (Pi). 



We use natural join x to combine compatible interpretations. 
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Definition 4.13 Given SMODELS program modules Pi and V 2 and sets of inter- 
pretations Ai C 2 At ^ Pl ) and A 2 C 2 At ( P2 \ ifte natural join of A\ and A 2 , denoted 
by A\ M A 2 , is 

{Ml U M 2 I Mi G Ax,M 2 G A 2 smc/i iftai Mi and M 2 are compatible}. 

The stable model semantics is compositional for U, that is, if a program (module) 
consists of several submodules, its stable models are locally stable for the respec- 
tive submodules; and on the other hand, local stability implies global stability for 
compatible stable models of the submodules. 

Theorem 4.14 (Module theorem (Qikarinen 20071) ) 7/ Pi andP 2 are SMOD- 
ELS program modules such that Pi U P2 is defined, then 

SM(Pi UP 2 ) = SM(Pi) x SM(P 2 ). 

Instead of proving Theorem 14.141 directly from scratch we will propose a general 
translation-based scheme for introducing syntactical extensions for the module the- 
orem. For this we need to define a concept of modular equivalence first, and thus 
the proof of Theorem 14.141 is deferred until Section 14.41 

It is worth noting that classical propositional theories have an analogous property 
obtained by substituting U for U and replacing stable models by classical models 
in Theorem |4.14[ that is, for any SMODELS programs Pi and P 2 , CM (Pi U P 2 ) = 
CM (Pi) x CM(P 2 ), where CM(P) = {M C At(P) | M |= P}. 

Example 4.15 Recall modules M n and R™ in Example \4-S\ In Example |^.7| we 
showed that M = {arc(l, 1), arc(2, 2), hc(l, 1), hc(2, 2)} is a stable model 0/H 2 . Now 
module R 2 has six stable models, but none of them is compatible with M . Thus by 
Theorem \Jl4\ there is no stable model N for H 2 U R 2 such that N n At(H 2 ) = M. 

The join H n UR n can be used to find any graph ofn nodes which has a Hamiltonian 
cycle. For instance H 2 U R 2 has four stable models: 

{arc(l, 2), arc(2, 1), hc(l,2), hc(2, 1), reached(l), reached(2)} 
{arc(l, 1), arc(l, 2), arc(2, 1), hc(l, 2), hc(2, 1), reached(l), reached(2)} 
{arc(l, 2), arc(2, 1), arc(2, 2), hc(l, 2), hc(2, 1), reached(l), reached(2)} 
{arc(l, 1), arc(l, 2), arc(2, 1), arc(2, 2), hc(l, 2), hc(2, 1), reached(l), reached(2)}. 

These models represent the four possible graphs of two nodes having a Hamiltonian 
cycle. ■ 

Theorem 14.141 straightforwardly generalizes for modules consisting of several sub- 
modules. Consider a collection of SMODELS program modules Pi, . . . , P„ such that 
the join Pi U • • • U P„ is defined (recall that U is associative) . We say that a collection 
of interpretations {Mi, . . . , M„} for modules Pi, . . . , P„, respectively, is compatible, 
if and only if Ma and Mj are pairwise compatible for all 1 < i,j < n. The natural 
join generalizes for a collection of modules as 

Ax X ■ • • N A n = {Mi U • • • U M n \ Mi G A l and {Mi, . . . , M„} is compatible}, 
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where A 1 C 2 At ^\ ...,A n C 2 At ( p "). 

Corollary 4.16 For a collection of SMODELS program modules Pi,...,P„ such 
that the join Pi U • • • U P„ is defined, it holds that 

SM(Pi U • • • U P„) = SM(Pi) x • • • x SM(P n ). 

Although Corollary 14. 16l enables the computation of stable models on a module-by- 
module basis, it leaves us the task of excluding mutually incompatible combinations 
of stable models. It should be noted that applying the module theorem in a naive 
way by first computing stable models for each submodule and finding then the 
compatible pairs afterwards, might not be preferable. 

Example 4.17 Consider SMODELS program modules 

Pi = <{a^ -&.},{&}, {a}, 0), 

P 2 = ({o^~c.},{c},{o},0}, and 

P 3 = <{c^~a.},{a},{c},0}, 

and their join P = Pi U P 2 U P 3 = {{a < b. b< c. c < a.}, 0, {a, b, c}, 0). We 

have SM(Pi) = {{a}, {b}}, SM(P 2 ) = {{b},{c}}, and SM(P 3 ) = {{a},{c}}. To 
apply Corollary \4-16\ for finding SM(P), a naive approach is to compute all stable 
models of all the modules and try to find a compatible triple of stable models Mi, 
M2, and M3 for Pi, P 2 , and P3, respectively. 

• Now {a} G SM(Pi) and {c} G SM(P 2 ) are compatible, since {a} n At v (P 2 ) = = 
{c} n At v (Pi). However, {a} G SM(P 3 ) is not compatible with {c} G SM(P 2 ), since 
{c} n At v (P 3 ) = {c} ^ = {a} n At v (P 2 ). On the other hand, {c} G SM(P 3 ) is not 
compatible with {a} G SM(Pi), since {a} n At v (P 3 ) = {a} ^ = {c} n At v (Pi). 

• Also {b} G SM(Pi) and {b} G SM(P 2 ) are compatible, but {b} G SM(Pi) is mcom- 
paiifole tci*ft {a} G SM(P 3 ). Nor is {b} G SM(P 2 ) compatible with {c} G SM(P 3 ). 

T/ims i/iere are no Mi G SM(Pi), A/ 2 G SM(P 2 ), and M 3 G SM(P 3 ) such that 
{Mi, M 2 ,M 3 } is compatible, which is natural as SM(P) =0. ■ 

It is not necessary to test all combinations of stable models to see whether we 
have a compatible triple. Instead, we use the alternative definition of stable models 
(Definition 14. 6p based on instantiating the module with respect to an input inter- 
pretation, and apply the module theorem similarly to the splitting-set theorem. One 
should notice that the set of rules in P presented in Example 14 . 1 71 has no non-trivial 
splitting sets, and thus the splitting-set theorem is not applicable (in a non-trivial 
way) in this case. 

Example 4.18 Consider SMODELS program modules Pi, P 2 , andP 3 from Example 
\4-lT\ Now, Pi has two stable models Mi = {a} and M 2 = {&}. 

• The set Mi n Ati(P 3 ) = {a} = A\ can be seen as an input interpretation for 
P 3 . Module P 3 instantiated with Ai has one stable model: SM(P 3 (Ai)) = {{a}}. 
Furthermore, we can use A 2 = {a} n At;(P 2 ) = to instantiate P 2 : SM(P 2 (A 2 )) = 
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{{6}}. However, {b} is not compatible with Mi, and thus there is no way to find a 
compatible collection of stable models for the modules starting from Mi . 

• We instantiate P 3 with M 2 (~) Ati(P 3 ) = = A 3 and get SM(P 3 (A 3 )) = {{c}}. 
Continuing with {c} n Ati(P 2 ) = {c} = A A , we get SM(P 2 (A 4 )) = {{c}}. Again, 
we notice that {c} is not compatible with M%, and thus it is not possible to find a 
compatible triple of stable models starting from Mi either. 

Thus we can conclude SM(P) = 0. ■ 

4-3 Equivalence relations for modules 

The notion of visible equivalence ( Janhun en 2Q06[) was introduced in order to neglect 
hidden atoms when logic programs or other theories of interest are compared on the 
basis of their models. The compositionality property from Theorem 14.141 enables 
us to bring the same idea to the level of program modules — giving rise to modular 
equivalence of logic programs. Visible and modular equivalence are formulated for 
SMODELS program modules as follows. 

Definition 4.19 For two SMODELS program modules P and Q, 

• P = v Q if and only i/At v (P) = At v ((Q>) and there is a bisection f : SM(P) -> SM(Q) 
such that for all M £ SM(P), 

M n At v (P) = f(M) n At v (Q); and 

• P = m Q if and only if Ati(P) = Ati(Q) and P = v Q. 

We note that the condition At v (P) = At v (Q) insisted on the definition of = v , 
implies At Q (P) = At c (Q) in the presence of At;(P) = Atj(Q) as required by the 
relation = m . Moreover, these relations coincide for completely specified SMODELS 
programs, that is modules P with At;(P) = 0. 

Modular equivalence lends itself for program substitutions in analogy to strong 
equivalence (Lifsc hTTz et al. 2001(1 . that is, the relation = m is a proper congruence 
for the join operator U. 

Theorem 4.20 (Congruence) LetV, Q andM. be SMODELS program modules such 
that PUl and QUR are defined. If P = m Q, then PUK = m QUK. 

The proof of Theorem 14.201 is given in |Appendix A| The following examples illus- 
trate the use of modular equivalence in practice. 

Example 4.21 Recall programs P = {a.} and Q — {a <— ~b. a <— b.} from 
Example \3.13[ We can define modules based on them: P = (P, {&}, {a}, 0} and Q — 
(Q, {b}, {a}, 0). Now it is impossible to define a module K based on R = {b <— a.} 
in a way that Qui would be defined. Moreover, it holds that P = m Q. ■ 

Example 4.22 Module HM" = {R" , I" , O" , {/}) is based on an alternative encod- 
ing for Hamiltonian cycle problem given in ^Simons et al. 2 002). In contrast to the 
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encoding described in Example \4-2[ this encoding does not allow us to separate the 
selection of the edges to the cycle and the checking of reached vertices into separate 
modules as their definitions are mutually dependent. The input signature of MR" 
is the same as for W 1 , that is, I" = I = {arc(iE, y) | 1 < x,y < n}. The output 
signature o/HDR™ is the output signature o/i" U M™, that is, 

O" = O U O' = {hc(x, y) | 1 < x, y < n} U {reached(x) 1 < x < n}. 

The set R" contains rules 

{hc(l,a;)} <— arc(l,a:) 

{hc(x, y)} «— reached (x), arc(x, y) 

reached(y) <— hc(x,y) 

/ <— ~/, ^reached(a;) 

/ «- ~fM{x,y),\\c{x,z) and (13) 

/ <- ~/,hc(a;,j/),hc(^y) (14) 

/or each 1 < x,y, z < n such that y ^ z in (T3\) and x ^ z in 

Now, one may notice that HR™ andM n UW l have the same input/output interface, 
and SM(HnET) = SM(H™ U W l ) which implies MR" = m H™ UK". ■ 

As regards the relationship between modular equivalence and previously proposed 
notions of equivalence, we note the following. First, if one considers the fully visible 
case, that is, the restriction Ath(P) = Ath(Q) = 0, modular equivalence can be seen 
as a special case of A-uniform equivalence for A = I. Recall, however, the restriction 
that input atoms may not appear in the heads of the rules as imposed by module 
structure. With a further restriction At;(P) = Atj(Q) = 0, modular equivalence 
basically coincides with weak equivalence because At(P) = At(Q) can always be 
satisfied by extending the interface of the module. Setting Atj(P) = At(P) would in 
principle give us uniform equivalence, but the additional condition Head(i?) Dl = 
leaves room for the empty module only. 

In the general case with hidden atoms, the problem of verifying = m for SMODELS 
program modules can be reduced to verifying = v for SMODELS programs. This 
is achieved by introducing a special module G/ containing a single choice rule, 
which acts as a context generator in analogy to (IWoltran 2004|) . We say that two 
modules P and Q are compatible if they have the same input/output interface, that 
is, Ati(P) = Ati(Q) and At Q (P) = At Q (Q). 

Lemma 4.23 Consider compatible SMODELS program modules P andQ. NowF = m 
<Q> if and only i/PUGj = v QUG/ where I = At ; (P) = Ati(Q) and G/ = 
({{/} <— }, 0, /, 0) generates all possible input interpretations for P and Q, 

Proof 

Notice that PUG; and QUG/ are SMODELS program modules with empty input 
signatures, and thus they can also be viewed as SMODELS programs. ( =4> ) Assume 
P = m Q. Since PUG/ and Q U Gj are defined, PUG; = m QUG; by Theorem 
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EPffl This implies PUGj e v QuG;. ( <= ) Assume P U G/ = v Q U G/, that 
is, At v (P) = At v (Q) and there is a bijection / : SM(P U G/) -> SM(Q U G/) such 
that for each M £ SM(P U G/), M (~l At v (P) = /(M) n At v (Q). By Theorem SH 
SM(PUG/) = SM(P) ix SM(G/) and SM(Q U Gj) = SM(Q) tx SM(Gj). Now, 
SM(Gj) = 2 1 , and thus SM(P U Gj) = SM(P) and SM(Q U G/) = SM(Q). This 
implies P = v Q, and furthermore P = m Q since P and Q are compatible SMODELS 
program modules. □ 

Due to the close relationship of = v and = m , the respective verification problems 
have the same computational complexity. As already observed in ([Janhunen and Oikarinen~ 2007) , 
the verification of P = v Q involves a counting problem in general and, in partic- 
ular, if At v (P) = At v (Q) = 0. In this special setting P = v <Q> holds if and only if 
|SM(P)| = |SM(Q)|, that is, the numbers of stable models for P and Q coincide. 
A reduction of computational time complexity can be achieved for modules that 
have enough visible atoms, that is, the EVA property. Basically, we say that mod- 
ule P = (R, I, O, H) has enough visible atoms, if and only if R has enough visible 
atoms with respect to At v (P) = I U O. However, the property of having enough 
visible atoms can be elegantly stated using modules. We define the hidden part of 
a module P = (R, I, O, H) as Ph = (Rh, I L) 0,H, 0) where i?h contains all rules of 
R involving atoms of H in their heads. For a choice rule {A} <— B, G R, we 
take the projection {A n H} <— B, in i?h- 

Definition 4.24 (The EVA property (Jan hunen and Qikarinen 2007(1 ) 

An SMODELS program module P = (R, I, O, H) has enough visible atoms if and 
only if the hidden part Ph = {Rh,, I U O, H, 0) has a unique stable model M for each 
interpretation N C At v (P) = I U O such that M n (/ U O) = N. 

Verifying the EVA property is coNP-hard and in for SMODELS programs ( Janhune n and Qikarinen 2 007. 
Proposition 4.14), and thus for SMODELS program modules, too. It is always pos- 
sible to enforce the EVA property by uncovering sufficiently many hidden atoms: 
a module P for which Ath(P) = has clearly enough visible atoms because Ph has 
no rules. It is also important to realize that choice rules involving hidden atoms in 
their heads most likely break up the EVA property — unless additional constraints 
are introduced to exclude multiple models created by choices. 

Based on the observations we can conclude that verifying the modular equiva- 
lence of modules with the EVA property is a coNP-complete decision problem. 
Motivated by the complexity result and by previous proposals for translating var- 
ious equivalence verification problems into the problem of computing stable mod- 
els (see (|Janhunen and Qikarinen 2002] ITurner 2003| IWoltran 2004jl for instance), 
we recently introduced a translation-based method for verifying modular equiva- 
lence (Qikarin en and Janhunen 2008b|l . In the following theorem, EQT(-, •) is the 
linear translation function mapping two SMODELS program modules into one SMOD- 
ELS program module presented in llOikarinen and Janhunen 200 8b. Definition 10). 
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Theorem 4.25 (( OTkarinen and Janhunen 2008b), Theorem 4)) Let P and 

Q be compatible SMODELS program modules with the EVA property, and C any 
SMODELS program module such that PUC and QUC are defined. Then PUC = m QuC 
if and only if SM(EQT(P, Q)UC) = SM(EQT(Q, P) U C) = 0. 

4-4 Proving the module theorem using a general translation-based 



Let us now proceed to the proof of the module theorem. We describe the overall 
strategy in this section whereas detailed proofs for the theorems are provided in 
|Appendix A| Instead of proving Theorem 14. 141 from scratch, we first show that the 
theorem holds for normal logic program modules, and then present a general scheme 
that enables us to derive extensions of the module theorem syntactically in terms 
of translations. 

We start by stating the module theorem for normal logic program modules. 

Theorem 4.26 ((Oik arinen and Janhunen 2006|> ) // Pi and P2 are normal 
logic program modules such that Pi U P2 is defined, then 



Next definition states the conditions which we require a translation function to 
have in order to achieve syntactical extensions to the module theorem. Intuitively, 
the conditions serve the following purposes: first, the translation has to be strongly 
faithful, that is, it preserves the roles of all atoms in the original module; second, 
it is U-preserving, that is, possible compositions of modules are not limited by the 
translation; and third, the translation is modular. 

For convenience, we define an operator reveal(P, A) — (R, 1,0 U A, H\ A) for 
any program module P = (R, I, O, H) and for any set of atoms A C H . The 
revealing operator is used to make a set of hidden atoms of a module visible to 
other modules. 

Definition 4.27 Let C\ and C2 be two classes of logic program modules such that 
C2 ^ Ci- A translation function Tr : C\ — > C2 is strongly faithful, modular and 
U-preserving, if the following hold for any program modules P, Q G C\ : 

1. reveal(P, At h (P)) = m reveal(Tr(P), At h (P)) ? - 

2. i/PUQ is defined, then Tr(P) UTr(Q) is defined; and 

3. Tr (P) U Tr (Q) = Tr(PUQ). 

Notice that the condition for strong faithfulness requires Ati(Tr(P)) = Ati(P), 
At (Tr(P))UAt h (P) = At (P)UAt h (P), and At h (P) C At h (Tr(P)) to hold. Moreover, 
strong faithfulness implies faithfulness, that is, P = m Tr(P). 

Theorem 4.28 Let C\ and C2 be two classes of logic program modules such that 
C2 C C\ and there is a translation function Tr : C\ — > C2 that is strongly faithful, 



extension scheme 



SM(Pi U P 2 ) = SM(Pi) ix SM(P 2 ). 
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U-preserving, and modular as given in Definition ^. 27\ If the module theorem holds 
for modules in C%, then it holds for modules in C\. 

The proof of Theorem 14,281 is provided in |Appendix A| 

As regards the translation from SMODELS program modules to NLP modules, it 
suffices, for example, to take a natural translation similarly to ( [Simons et al. 2002 ). 
Note that the translation presented in Definition 14.291 is in the worst case exponen- 
tial with respect to the number of rules in the original module. For a more compact 
translation, see IjFerraris and Lifschitz 20 05). for example. 

Definition 4.29 Given an SMODELS program module P = (R,I,0,H), its trans- 
lation into a normal logic program module is TrNLp(P) = (R' , 1,0, H U H') , where 
R' contains the following rules: 

• for each choice rule {A} <— B, £ R the set of rules 

{a <— B, ~C, ~a. a <— ~a | a 6 A}; 

• for each weight rule a <— w < {B = Wb, ~C = Wc} 6 R the set of rules 

{a <- B', ~C" | B' C B, C C C and w < J2 Wb+ Yl Wc ^ 

beB' cec 

where each a is a new atom not appearing in At(P) and H' = {a \ a £ Choices(i?)}. 

Theorem 4.30 The translation TrNLP from SMODELS program modules to normal 
logic program modules given in Definition \4-29\ is strongly faithful, U-preserving, 
and modular. 

The proof of Theorem 14.301 is given in |Appendix A 

The module theorem now directly follows from Theorems 14.261 14.28^ and 14.301 

Proof of Theorem \4-14\ 

By Theorem 14. 261 we know that the module theorem holds for normal logic program 
modules. Theorem [428] shows that Definition l4.27l gives the conditions under which 
Theorem l4. 261 can be directly generalized for a larger class of logic program modules. 
By Theorem 14.301 we know that the translation TrNLP from SMODELS program 
modules to NLP modules introduced in Definition 14. 291 satisfies the conditions given 
in Definition I4.27[ and therefore SMODELS program modules are covered by the 
module theorem. □ 

4-5 Comparison with earlier approaches 

Our module system resembles the module system proposed in ( Gaifman and Shapiro 1 989). 
However, to make our system compatible with the stable model semantics we need 
to introduce a further restriction of mutual dependence, that is, we need to deny 
positive recursion between modules. Also other propositions involve similar condi- 
tions for module composition. For example, Brogi et al. (1994) employ visibility 
conditions that correspond to respecting hidden atoms. However, their approach 
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covers only positive programs under the least model semantics. Maher (1993f for- 
bids all recursion between modules and considers Przymusinski's perfect models 
( jPrzymusi nski 1988) rather than stable models. Etalle and Gabbrielli fl!996[) re- 
strict the composition of constraint logic program ( Ja ffar and Maher 1994j) modules 
with a condition that is close to ours: At(P) fl At(Q) C At v (P) (~l At v (Q) but no 
distinction between input and output is made, for example, At (P) D At Q (Q) ^ 
is allowed according to their definitions. 

Approaches to modularity within ASP typically do not allow any recursion (nega- 
tive or positive) between modules (|Eiter et al. 1997jlTari et al. 2 005; Lif schitz and Turner 1994: 
IGelfond and Gabaldo n 1999|) . Theorem l4.14l the module theorem, is strictly stronger 
than the splitting-set theorem (Lifschit z and Turner 1994]) for normal logic pro- 
grams, and the general case allows us to generalize the splitting-set theorem for 
SMODELS programs. Consider first the case of normal logic programs. A splitting of 
a program can be used as a basis for a module structure. If U is a splitting set for 
a normal logic program P, then we can define 

P = B U T = (MP), 0, U, 0) U (tu(P), U, At(P) \ U, 0). 

It follows directly from Theorems EH and gH that M x 6 SM(B) and M 2 e SM(T) 
are compatible if and only if (Mi, M 2 \ U) is a solution for P with respect to U . 

Example 4.31 Consider a normal logic program P = {a <— ~&. b <— ~a. c <— a.}. 
The set U = {a, 6} is a splitting set for P, and therefore the splitting set-theorem 
(Theorem Iff, 6\) can be applied: by(P) = {a <— ~6. 6 <— ^a.} and t[/(P) = {c <— 
a.}. TVow Mi = {a} anrf M 2 — {b} are the stable models ofbu(P), and we can 
evaluate the top with respect to Mi and M 2 , resulting in solutions (Mi,{c}) and 
(M2,0), respectively. On the other hand, P can be seen as join of modules Pi = 
OMP),0,f/,0) and¥ 2 = (tu{P), U, {c}, 0) . Now, we have SM(Pi) = {Mi,M 2 } and 
SM(P2) = {0, {&}, {a, c}, {a, 6, c}}. Out of eight possible pairs only (Mi, {a, c}) and 
(M 2 ,{b}) are compatible. 

However, it is possible to apply Theorem \4 M\ similarly to the splitting-set theo- 
rem, that is, we only need to compute the stable models of V 2 compatible with the 
stable models of Pi . Notice that when the splitting-set theorem is applicable, the 
stable models of Pi fully define the possible input interpretations for V 2 . This leaves 
us with stable models {a, c} and {b} for the composition. ■ 

On the other hand, consider the module Pi = (b[/(P), 0, U, 0) in the above ex- 
ample. There are no non-trivial splitting sets for the bottom program bj/(P) = 
{a <— b <— ~a.}. However, Pi can be viewed as the join of two NLP mod- 
ules Qi = ({a < &.}, {6}, {a}, 0), and Q 2 = ({b < a.}, {a}, {6}, 0) to which the 

module theorem is applicable. 

In the general case of SMODELS program modules we can use the module theorem 
to generalize the splitting-set theorem for SMODELS programs. Then the bottom 
module acts as an input generator for the top module, and one can simply find the 
stable models for the top module instantiated with the stable models of the bottom 
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module. The latter strategy used in Example 14.311 works even if there is negative 
recursion between the modules, as already shown in Example 14.181 

The module theorem strengthens an earlier version given in l|Janhunen 2 006) 
to cover programs that involve positive body literals, too. The independent sets 
proposed by Faber et al. (J20j)5) push negative recursion inside modules which is 
unnecessary in view of our results. Their version of the module theorem is also 
weaker than Theorem 14. 141 

The approach to modularity based on lp-functions IjGelfond and G abaldon 1999} 
IBaral 2003| has features similar to our approach. The components presented by 
lp-functions have an input/output interface and a domain reflecting the possible 
input interpretations. The functional specification requires an lp-function to have 
a consistent answer set for any interpretation in its domain. This is something that 
is not required in our module system. Lp-functions are flexible in the sense that 
there are several operators for refining them. However, the composition operator 
for lp-functions allows only incremental compositions, which again basically reflects 
the splitting-set theorem. 

5 More on program (de) composition 

So far we have established a module architecture for the class SMODELS programs, 
in which modules interact through an input/output interface and the stable model 
semantics is fully compatible with the architecture. In this section we investigate 
further the ways to understand the internal structure of logic programs by seeing 
them as compositions of logic program modules. First, we use the conditions for 
module composition to introduce a method for decomposing an SMODELS program 
into modules. A more detailed knowledge of the internal structure of a program (or a 
module) might reveal ways to improve search for stable models. Another application 
can be found in modularization of the translation-based equivalence verification 
method in l|Oikarinen and Janhunen 2008b|l . Second, we consider possibilities of 
relaxing the conditions for module composition, that is, whether it is possible to 
allow positive recursion between modules in certain cases. 

5.1 Finding a program decomposition 

Recall that any SMODELS program P can be viewed as a module (P, 0, At(P), 0), and 
thus we consider here a more general case of finding a module decomposition for an 
arbitrary SMODELS program module P = (R, I, O, H). The first step is to exploit the 
strongly connected components D\ , . . . , D n of Dep + (P) and define submodules P,: 
by grouping the rules so that for each Di all the rules r S R such that Head(r) C Di 
are put into one submodule. 

Now, the question is whether Pj's defined this way would form a valid decomposi- 
tion of P into submodules. First notice that input atoms form a special case because 
Head(i?) HI = 0. Each a £ I ends up in its own strongly connected component and 
there are no rules to include into a submodule corresponding to strongly connected 
component {a}. Thus it is actually unnecessary to include a submodule based on 
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such a component. Obviously, each weight rule in R goes into exactly one of the 
submodules. One should notice that for a choice rule r £ R it can happen that 
Head(r) n A ^ and Hcad(r) C\Dj^% for ij^j. This is not a problem, since it is 
always possible to split a choice rule by projecting the head, that is, by replacing a 
choice rule of the form {A} <— B, ~C with choice rules {^4 n A} <— B, for each 
SCC A such that A n A ¥= 00 

Based on the discussion above, we define the set of rules defining a set of atoms 
for an SMODELS program module. 

Definition 5.1 Given an SMODELS program module P = (R, I, 0,H) and a set of 
atoms D C At(P) \ /, the set of rules defining D, denoted by R[D], contains the 
following rules: 

• a choice rule {A n D} *— B, if and only if there is a choice rule {A} <— B, 
in R such that An D ^ 0; and 

• a weight rule a <— w < {B = Wb,^C = Wc} if and only if there is a weight 
rule a <— w < {B = Wb,~C — Wc] in R such that a e D. 

We continue by defining a submodule of P = (R, I, O, H) induced by a set of 
atoms D C At(P) \ /. We use Definition 15.11 for the set of rules, and choose D (~l O 
to be the output signature and the rest of the visible atoms appearing in R[D] to 
be the input signature. 

Definition 5.2 Given an SMODELS program module P = (R, /, 0,H) and a set of 
atoms D C At(P) \I, a submodule induced by D is 

V[D] = {R[D], (At(R[D]) \D)n{lUO),Dr\0,Dn H). 

Let D\,... D m be the strongly connected components of Dep + (P) such that Di n 
1 — 9. Now we can define Pj = P[A] for each 1 < i < m. Since the strongly 
connected components of Dep + (P) are used as a basis, it is guaranteed that there 
is no positive recursion between any of the submodules Pj. Also, it is clear that 
the output signatures of the submodules are pairwise disjoint. Unfortunately this 
construction does not yet guarantee that hidden atoms stay local, and therefore 
the composition Pi • • • ©P m might not be defined because certain Pj's might not 
respect each others hidden atoms. 

A solution is to combine A's in a way that modules will be closed with respect 
to dependencies caused by the hidden atoms, that is, if a hidden atom h belongs 
to a component Di, then also all the atoms in the heads of rules in which h or ~/i 
appears, have to belong to Di, too. This can be achieved by finding the strongly 
connected components, denoted by Ex, . . . , Ek, for Dep h (P, {A, ■ ■ • , D m }), where 



5 Note that in the case of disjunctiv e logic programs, splitting a rule into two modules is more 
involved, see Jjanhunen et al. 2007) for a discussion on a general shifting principle. 
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Dep h (P, {Di, . . . , D m }) has {-Di, . . . , D m } as the set of vertices, and 

{(A, Dj), (Dj,Di) | a e D h b E Dj, r e R, 

b G Head(r) and a G Body(r) n At h (P)} 

as the set of edges. Now, we take the sets 

p i= U D 

for 1 < i < k and use them to induce a module structure for P by defining Pi = P[fi] 
for 1 < i < k. 

As there may be atoms in At(P) not appearing in the rules of P, that is, At(P) = 
At(i?) does not necessarily hold for P = (R,I,0,H), it is possible that 

At(P) \ (At(Pi) U ■ ■ • U At(P fe )) ^ 0. 

To keep track of such atoms in I \ At(i?) we need an additional module defined as 

Po = <0,/\At(i?),0,0). 

There is no need for a similar treatment for atoms in (O U H) \ At(i2) as each atom 
in O U H belongs to some At (Pi) by definition. 

Theorem 15.31 shows that we have a valid decomposition of P into submodules. 

Theorem 5.3 Consider an SMODELS program module P, and let D±, . . . D m be the 
SCCs of Dep + (P) such that Di D I = 0, and E\, . . . ,Ek the strongly connected 
components of Dep h (P, {D lt . . . , D m }). Define P = (0, / \ At(R), 0, 0), and P t = 
P[Fi] for Fi — Udg-E D and 1 < i < k. Then the join of the submodules Pi for 
0<i<k is defined and P = m P U • • • U P fc . 

Proof 

Based on the construction of Fj's and the discussion in this section it is clear that 
P' = Po U • • • U Pfc is defined. It is easy to verify that the sets of input, output, and 
hidden atoms of modules P' and P are exactly the same. The only difference between 
the sets of rules in P and P' is that some choice rules in P may have been split into 
several rules in P'. This is a syntactical change not affecting the stable models of 
the modules, that is, SM(P) = SM(P'). Notice also that Dep+(P) = Dcp + (P'). Thus 
it holds that P' = m P. □ 

5.2 Semantical conditions for module composition 

Even though Example 14.91 shows that conditions for © are not enough to guarantee 
that the module theorem holds, there are cases where PU Q is not defined and still 
it holds that SM(P © Q) = SM(P) N SM(Q). 

Example 5.4 Consider modules P = ({a <— b. a <— ~c.}, {b}, {a, c}, 0) and Q = 
({b <— a.}, {a}, {b}, 0) . Now, the composition 

P © Q = ({ a <- b. a < c. b <- a.}, 0, {a, 6, c}, 0) 
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is defined as the output sets are disjoint and there are no hidden atoms. Since 
SM(P) = {{a}, {a, b}} and SM(Q) = {0,{a,6}}, we get SM(P © Q) = {{a,b}} = 
SM(P) x SM(Q). ■ 



Example 15.41 suggests that the denial of positive recursion between modules can 
be relaxed in certain cases. We define a semantical characterization for module 
composition that maintains the compositionality of the stable model semantics. 

Definition 5.5 The semantical join Pi]JP 2 of two SMODELS program modules Pi 
andP 2 isPi©P 2 , provided Pi ©P 2 is defined andSM(Pi©P 2 ) = SM(Pi) m SM(P 2 ). 

The module theorem holds by definition for SMODELS program modules composed 
with U. We can now present an alternative formulation for modular equivalence 
taking features from strong equivalence (Lifschitz et al. 2001). 

Definition 5.6 SMODELS program modules P and Q are semantically modularly 
equivalent, denoted by P = scm Q, if and only if At ; (P) = Atj(Q) and PUR = v QjJR 
for all R such that PUR and QUR are defined. 

It is straightforward to see that = SC m is a congruence for U and reduces to = v for 
modules with completely specified input, that is, modules P such that Ati(P) = 0. 

Theorem 5.7 P = m Q if and only ifV e sci11 Q for any SMODELS program modules 
P and Q. 

Proof 

Assume P = sem Q- Now, P = m Q is implied by Definition 15.61 with empty context 
module E = (0,0,0,0). Assume then P = m Q, that is, there is a bijection / : 
SM(P) -> SM(Q) such that for each M e SM(P), M n At v (P) = f(M) n At v (Q). 
Consider arbitrary K such that PUR and QUR are defined. Then SM(PL«) = 
SM(P) tx SM(E) and SM(QUR) = SM(Q) m SM(R), 

We now define g : SM(PUR) -> SM(QUM) such that for any M G SM(PUR), 

g{M) = f(M P ) U M R , 

where M = M P U M R such that M P £ SM(P) and M R £ SM(R) are compatible. 
Now, g is a bijection and M n (At v (P) U At v (M)) = g(M) n (At v (Q) U At v (R)) for 
each M 6 SM(PUR). Since R was arbitrary, P = sem Q follows. □ 

Theorem 15.71 implies that = m is a congruence for U, too. Thus it is possible to 
replace P with modularly equivalent Q in the contexts allowed by U, 

The syntactical restriction denying positive recursion between modules is easy 
to check, since SCCs can be found in a linear time with respect to the size of the 
dependency graph (Tarjan 1972). To the contrary, checking whether SM(Pi©P2) = 



SM(Pi) ix SM(P 2 ) is a computationally harder problem. 

Theorem 5.8 Given SMODELS program modules Pi and P 2 such that Pi © P 2 is 
defined, deciding whether it holds that SM(Pi © P 2 ) = SM(P X ) N SM(P 2 ) is a 
coNP -complete decision problem. 
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Proof 

Let Pi and P 2 be SMODELS program modules such that Pi © P2 is defined. We can 
show SM(Pi 0P 2 ) + SM(Pi) n SM(P 2 ) by choosing M C At (Pi ©P 2 ) and checking 
that 

• Me SM(Pi © P 2 ) and M n At (Pi) £ SM(P X ); or 

• Me SM(Pi © P 2 ) and M n At(P 2 ) £ SM(P 2 ); or 

• M SM(Pi © P 2 ) : M n At (Pi) e SM(Pi), and M n At(P 2 ) e SM(P 2 ). 

Once we have chosen M, these tests can be performed in polynomial time, which 
shows that the problem is in coNP. To establish coNP-hardness we present a 
reduction from 3SAT. Consider a finite set S — {C\, . . . , C„} of three- literal clauses 
Ci of the form l\ V Z 2 V I3 where each U is either an atom a or its classical negation 
->a. Each clause Ci is translated into rules r^j of the form Ci <— fj, where 1 < j < 3, 
and fj — a if lj — a and fj = ~a if lj = ->a. The intuitive reading of c; is that 
clause Ci is satisfied. We define modules Pi = ({e <— d.}, {d}, {e}, 0} and 

P 2 = ({r w I 1 < i < n, 1 < j < 3} U {d <- e, ci, . . . , c„.}, 

At(5)U{e},{d},{ci,...,c„}). 

Now Pi ©P 2 is defined, and SM(Pi) = {0,{d,e}}. There is M e SM(P 2 ) that is 
compatible with {d, e} if and only if S G 3SAT. Since d g" TV and e ^ N for all 
TV e SM(Pi©P 2 ), it follows that S G 3SAT if and only if SM(Pi ©P 2 ) = SM(Pi) n 
SM(P 2 ). □ 

Theorem 15.81 shows that there is a tradeoff for allowing positive recursion between 
modules, as more effort is needed to check that composition of such modules does 
not compromise the compositionality of the stable model semantics. 

6 Tools and Practical Demonstration 

The goal of this section is to demonstrate how the module system introduced in 
Section |4] can be exploited in practise in the context of the SMODELS system and 
other compatible systems. In this respect, we present tools that have been developed 
for the (de) composition of logic programs that are represented in the internal file 
formal of the SMODELS engine. The binaries for both tools are available under 
the ASPTOOLS collection^. Moreover, we conduct and report a practical experiment 
which illustrates the performance of the tools when processing substantially large 
benchmark instances, that is, SMODELS programs having up to millions of rules (see 
the ASPTOOLS web page for examples). 

The first tool, namely MODLIST, is targeted at program decomposition based 
on the strongly connected components of an SMODELS program given as input. 
In view of the objectives of Section I5.1[ there are three optional outcomes of the 
decomposition, that is, strongly connected components that take into account 



6 The reader is referred to ( Janhunen 2007) for a detailed description and analysis of the format. 

7 http : //www .tcs .hut . f i/Sof tware/asptools/ 



30 



E. Oikarinen and T. Janhunen 



1. positive dependencies only, 

2. positive dependencies and hidden atoms, and 

3. both positive and negative dependencies as well as hidden atoms. 

The number of modules created by MODLIST decreases in this order. However, our 
benchmarks cover program instances that get split in tens of thousands of modules. 
To tackle the problem of storing such numbers of modules in separate files we 
decided to use file compression and packaging tools and, in particular, the ZIP 
utility available in standard Linux installations. We found ZIP superior to TAR as 
it allows random access to files in an archive, or a zipfile. This feature becomes 
valuable when the modules are accessed from the archive for further processing. 

The tool for program composition has been named as LPCAT which refers to 
the concatenation of files containing logic programs. A new version of the tool 
was implemented for experiments reported below for better performance as well as 
usability. The old version (version 1.8) is only able to combine two modules at a 
time which gives a quadratic nature for a process of combining n modules together: 
modules are added one-by-one to the composition. The new version, however, is 
able to read in modules from several files and, even more conveniently, a stream 
of modules from an individual file. The zip facility provides an option for creating 
such a stream that can then be forwarded for lpcat for composition. This is the 
strategy for composing programs in experiments that are described next. 

To test the performance of our tools, we picked a set of benchmark instances 
having from tens of thousands up to millions of rules — expressed in the SMODELS 
format. For each instance, the first task is to decompose the instance into modules 
using MODLIST and to create a zipfile containing the modules. The type of modules 
to be created is varied according the three schemes summarized above. The second 
task is to recreate the benchmark instance from a stream of modules extracted from 
the respective zipfile. As suggested above, the actual composition is carried out 
using lpcat and we also check that the number of rules matches with the original 
instance. Due to high number of rules, checking the equivalence of the original and 
composed programs (|Janhunen and Oikarinen 2007|) is unfeasible in many cases. If 
all atoms are visible, this can be accomplished syntactically on the basis of sorted 
textual representations of the programs involved. To ensure that modlist and 
lpcat produce correct (de) compositions of programs, such a check was performed 
for all compositions created for the first three benchmarks which involve no hidden 
atoms. As regards computer hardware, we run modlist and lpcat on a PC with 
a 1.8GHz Intel Core 2 Duo CPU and 2GBs of main memory — operating under the 
Linux 2.6.18 system. In experimental results collected in TableHJ we report the sum 
of user and system times that are measured with the /usr/bin/time command. 
There are three benchmark types (bt for short) as enumerated in the beginning of 
this section. We refer to them using the respective abbreviations +, +h, and ±h. 

The first benchmark instance in Table[H viz. ephp-13, is a formalization (jJarvisalo and Oikarinen 2007|) 
of the classical pigeon hole principle for 13 pigeons — extended by redundant rules in 
analogy to Tseitin's extended resolution proof system. This program can be deemed 
medium-sized within our benchmarks. There are no hidden atoms, no positive re- 
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Benchmark na nr bt nm dt (s) ct (s) 



ephp-13 35 518 90 784 + 35 518 2 110 362 

+h 35 518 2 110 362 
±h 35 362 2 090 361 



mutex3 276 086 2 406 357 + 101 819 22 900 9 570 

+h 101 819 23 300 9 640 
±h 101 609 24 000 9 580 



phi3 7 379 14 274 + 6 217 74,3 3,32 

+h 6 217 74,3 3,35 
±h 5 686 63,2 2,92 



seq4-ss4 6 873 1 197 182 + 3 425 121 60,0 

+h 1 403 89,4 31,9 
±h 107 20,2 7,58 



Legends for abbreviations: na: Number of atoms 

nr: Number of rules 

nm: Number of modules 

bt: Benchmark type 

dt: Decomposition time 

ct: Composition time 

Table 1. Summary of benchmark results for module (de) composition 



cursion and little negative recursion in this program instance as indicated by the 
number of atoms (35 518) and the respective numbers of modules (see column nm). 
Thus we have an example of a very fine-grained decomposition where the definitiorxj 
of each atom ends up as its own module in the outcome. The given timings indi- 
cate that modlist and lpcat are able to handle 15 and 100 modules per second, 
respectively. The share of file I/O and (de) compression is substantial in program 
decomposition. For instance, the actual splitting of the ephp-13 benchmark (+h) 
using modlist takes only 0, 59 seconds — the rest of approximately 2110 seconds is 
spent to create the zipfile. To the contrary, inflating the stream of modules from 
the zipfile is very efficient as it takes only 0,45 seconds in case of ephp-13. After 
that the restoration of the original program instance takes roughly 361 seconds. 
The creation and compression of a joint symbol table for the modules accounts for 
the most of the time spent on this operation. It should also be stressed that it is 
impractical to store modules in separate files for this program. For instance, a shell 
command that refers to all modules fails due to excessive number of arguments at 
the respective command line. 

The next two programs in Tabled mutex3 and phi3, are related to the distributed 



The set of rules that mention the atom in question in their head. 
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implementability problem of asynchronous automata, and particular formalizations 
of classical mutual exclusion and dining philosophers problems (Heljanko and §tefanescu 2004; 
|Heljanko and §tefanescu 2005[ ) . These programs involve no hidden atoms and both 
positive and negative interdependencies of atoms occur. The extremely high num- 
bers of rules (2406357) and modules (101819) are clearly reflected in running times 
perceived for mutexS. However, the respective rates of 4 and 10 modules per second 
do not differ too much from those obtained for ephp-13 given the fact that the 
number of rules is about 25 times higher. The data observed for phi3 is analogous 
to those obtained for ephp-13 and mutex3 but the respective modules-per-second 
rates are much higher: approximately 90 and 2000. This may partly boil down to the 
fact phiS is the smallest program under consideration and it has also the smallest 
number of rules per module ratio. 

Our last benchmark program, seq4~ss4, is taken from benchmark sets of (Bra in et al. 2 006) 
where the optimization of machine code using ASP techniques is of interest. The 
program in question formalizes the optimization of a particular sequence of four 
SPARC-v7 instructions. This program instance has the greatest modules as re- 
gards the number of rules — the average number of rules per module varies from 
about 350 to 11200 depending on the module type. It has also hidden atoms which 
makes a difference between modules based on plain SCCs and their combinations 
induced by the dependencies caused by the use of hidden atoms. The respective 
modules-per-second rates 28, 19, and 5 are all better than 4 obtained for mutexS. 

To provide the reader with a better idea of sizes of individual modules, we have 
collected some numbers about their distribution in Table O Each program involves 
a substantial number of modules with just one rule each of which defines a single 
atom of interest. On the other hand, the largest SCCs for ephp-13, mutex3, phi3, and 
seq4-ss4 involve 949, 2091912, 2579, and 1071689 rules, respectively. For mutexS, 
the biggest module consists of a definition of an equivalence relation over states 
in the verification domain — creating a huge set of positively interdependent atoms. 
For ephp-13, the greatest module is a collection of nogoods which can be shown 
to have no stable models in roughly 99500 seconds using SMODELS (version 2.32). 
However, the remaining rules of ephp-13 make this fact much faster to prove: only 
61 seconds elapse. 

A few concluding remarks follow. Increasing the number of modules in a program 
tends to decrease the number of modules that can be decomposed per time unit. 
This observation suggests that the creation of the zipfile has a quadratic flavor 
although modules themselves can be figured out in linear time (using a variant of 
Tarjan's algorithm). Perhaps this can be improved in the future by better integrat- 
ing the creation of the zipfile into modlist. For now, it creates a shell script for this 
purpose. Handling the biggest program instances is also subject to the effects of 
memory allocation which may further slow down computations. On the other hand, 
the cost of increasing the number of rules in modules seems to be relatively small. 
Moreover, it is clear on the basis of data given in Table Q] that the composition of 
programs is faster than decomposition. This would not be the case if the old version 
of lpcat were used for composition. Last, we want to emphasize that modlist and 
lpcat have been implemented as supplementary tools that are not directly related 
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Benchmark 


ephp-13 


mutex3 


phi3 


seq-ss4 


nr 




nm 






1 


14 474 


67 749 


2 811 


2 969 


2 


7 014 


2 757 


1 434 




3-4 


12 680 


41 


1 962 




5-8 


149 


30 798 


2 




9-16 


618 


255 


6 




17-32 


582 






11 


33-64 






1 




65-128 








134 


129-512 








296 


513-1 024 


1 






9 


over 1 024 




2 


1 


2 



Table 2. Distribution of the sizes of modules (see Table Q] for legends) 

to the computation of stable models. Nevertheless, we intend to exploit these tools 
in order to modularize different tasks in ASP such as verifying ordinary /modular 
equivalence and program optimization. The existence of such tools enables modular 
program development and the creation of module libraries for SMODELS programs, 
and thus puts forward the use of module architectures in the realm of ASP. 

7 Conclusions 

In this paper, we introduce a simple and intuitive notion of a logic program module 
that interacts with other modules through a well-defined input/output interface. 
The design has its roots in a module architecture proposed for conventional logic 
programs (Gaifma n and Shapiro 1989| , but as regards our contribution, we tailor 
the architecture in order to better meet the criteria of ASP. Perhaps the most im- 
portant objective in this respect is to achieve the compositionality of stable model 
semantics, that is, the semantics of an entire program depends directly on the 
semantics assigned to its modules. To this end, the main result of this paper is for- 
malized as the module theorem (Theorem 14. 14[) which links program-level stability 
with module-level stability. The theorem holds under the assumption that positively 
interdependent atoms are always placed in the same module. The join operation U 
defined for program modules effectively formalizes this constraint — which we find 
acceptable when it comes to good programming style in ASP. 

The module theorem is also a proper generalization of the splitting-set theo- 
rem (jLifschitz and Turner 19 94) recast for SMODELS programs. The main differ- 
ence is that splitting-sets do not enable any kind of recursion between modules. 
Even though the module theorem is proved to demonstrate the feasibility of the 
respective module architecture, it is also applied as a tool to simplify mathe- 
matical proofs in this paper and recently also in ( Oikarin en and Janhunen 2 008a; 
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Qikar men and Janhunen 2008b|l . It also lends itself to extensions for further classes 
of logic programs which can be brought into effect in terms of strongly faithful, Li- 



preserving, and modular translations for the removal of new syntax (Theorem l4.28p . 

Moreover, the module theorem paves the way for the modularization of various rea- 
soning tasks, such as search for answer sets, query evaluation, and verification, in 



The second main theme of the paper is the notion of modular equivalence which is 
proved to be a proper congruence relation for program composition using U (Theo- 
rem 220]). Thus modular equivalence is preserved under substitutions of modularly 
equivalent program modules. Since uniform equivalence is not a congruence for 
ordinary U but strong equivalence is by definition, modular equivalence can be 
viewed as a reasonable compromise between these two extremes. In addition to the 
congruence property, we present a number of results about modular equivalence. 

1. We show that deciding modular equivalence forms a coNP-complete decision 
problem for SMODELS program modules with the EVA property, that is, those 
having enough visible atoms so that their stable models can be distinguished 
from each other on the basis of visible atoms only. In this way, it is possible 
to use the SMODELS solver for the actual verification task. 

2. We consider the possibility of redefining the join operation U using a se- 
mantical condition that corresponds to the content of the module theorem. 
The notion of modular equivalence is not affected, but the cost of verifying 
whether a particular join of modules is defined becomes a coNP-complete 
decision problem. This is in contrast with the linear time check for positive 
recursion (Tarjan's algorithm for strongly connected components) but it may 
favorably extend the coverage of modular equivalence in certain applications. 

3. Finally, we also analyze the problem of decomposing an SMODELS program 
into modules when there is no a priori knowledge about the structure of the 
program. The strongly connected components of the program provide the 
starting point in this respect, but the usage of hidden atoms may enforce a 
higher degree of amalgamation when the modules of a program are extracted. 

The theoretical results presented in the paper have emerged in close connection 
with the development of tools for ASP. The practical demonstration in Section 
[6] illustrates the basic facilities that are required to deal with object level modules 
within the SMODELS system^ The linker, namely LPCAT, enables the composition of 
ground programs in the SMODELS format. Using this tool, for instance, it is possible 
to add a query to a program afterwards without grounding the program again. On 
the other hand, individual modules of a program can be accessed from the zipfile 
created by the module extractor MODLIST. This is highly practical since we intend 
to pursue techniques for module-level optimization in the future. 



Likewise, source level modules could be incorporated to the front-end of the system (lparse). 




ASP. 
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Proof of Theorem \4-20\ 

Let P and Q be modules such that P = m Q. Let R be an arbitrary module such 
that PUM and QUI are defined. From At v (P) = At v (<Q>) and Ati(P) = Atj(Q) it 
follows that At v (P U R) = At v (Q U R) and At ; (P UR) = Ati(Q U R). 

Consider any model M G SM(P U R). By Theorem EH SM(P UR) = SM(P) x 
SM(R), that is, M P = M n At(P) G SM(P) and Mr = M n At(R) G SM(R). Since 
P = m Q, there is a bijection / : SM(P) -> SM(Q) such that M P G SM(P) ^> 
f{M P ) G SM(Q), and 



Denote Mq — f(Mp). Clearly, Mp and Mp are compatible. Since (|Al[) holds, 
also Mq and Mr are compatible. Applying Theorem 14.141 we get Mq U Mp G 
SM(QUR) = SM(Q) xi SM(R). 

Now, define a function g : SM(P UR) -> SM(Q U R) as 



Function g is a bijection, since 

• g is an injection: M ± N implies g(M) ^ ff(iV) for all M,N £ SM(PUR), since 
f(M n At(P)) ^ f(N n At(P)) or M n At(R) ^ TV n At(R). 

• g is a surjection: for any M e SM(Q UR), N = / _1 (M n At(Q)) U (M n At(R)) G 
SM(P U R) and ff(JV) = M, since / is a surjection. 

The inverse function g' 1 : SM(Q U R) -> SM(P U R) can be defined as g~ 1 (N) = 
f- x (N n At(Q)) U (N n At(R)). Thus PUM = m Q U R. □ 

Proof of Theorem \4-26\ 

We present an alternative proof to the one given in ( Oikarin en and Janhun en 2006). 
We use the characterization of stable models based on the programs completion and 
loop formulas presented in Theorem 13. 101 

First, we need to generalize the concepts of completion and loop formulas for 
NLP modules. Given a normal logic program module P = (R, I, O, H), we define 



Appendix A Proofs 



M P n Atv(P) = f(M P ) n At v (Q). 



(Al) 



g{M) = f(M n At(P)) U (M n At(R)). 



Clearly, g maps the set of visible atoms in M to itself, that is, 



M n (At v (P U R)) = g(M) n (At v (Q U R)). 




(A2) 
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that is, we take the completion in the normal way for the set of rules R with the 
exception that we take into account that input atoms do not have any defining 
rules. As regards loop formulas, we define LF(P) = ~LF(R), since no atom in the 
input signature can appear in any of the loops. 

Consider an arbitrary NLP module P = (R, I, O, H). Define a set of rules, that is, 
a conventional normal logic program, R' = RLiGi, where Gj = {a <— ~a. a <— ~a | 
a G /} and all atoms a are new atoms not appearing in At(P). Now, M G SM(P) if 
and only if N = MU{a \ a G I\M] G SM(R'). On the other hand, bv Theorem l3~10l 
N G SM(R') if and only if N \= Comp(R') U LF(R'). Considering the completion, 
since Head(i?) (II = 0, and atoms a are new, it holds that Comp(i?') = Comp(P) U 
Comp(G/). As regards loop formulas, we notice that Dep + (i?') is Dep + (i?) together 
with vertices for atoms {a \ a G /}, which have no edges in Dep + (i?'). Therefore, 
LF(R') = LF(R) = LF(P). 

Thus N \= Comp(E') ULF( J R / ) if and only if JV |= Comp(P) UComp(G/) ULF(P). 
Furthermore, based on the relationship between M and N, it holds that N ^ 
Comp(P)UComp(G/)ULF(P) if and only if M \= Comp(P) ULF(P). Thus Theorem 
13.101 generalizes directly for NLP modules: given a normal logic program module 
P and an interpretation M C At(P), it holds that M G SM(P) if and only if 
M \= Comp(P) ULF(P). 

Now, since the join operation does not allow positive recursion between two 
modules, and (At Q (Pi) U At h (Pi)) n (At (P 2 ) U At h (P 2 )) = 0, it holds that 

Comp(PiUP 2 ) = Comp(Pi) U Comp(P 2 ), and (A3) 
LF(PiUP 2 ) = LF(Pi) ULF(P 2 ). (A4) 

Furthermore, the satisfaction relation is compositional for U, that is, M \= PUQ 
if and only if M R At(P) |= P and M (~l At(Q) |= Q for any prepositional theories 
P and Q. Thus 

M G SM(Pi U P 2 ) <S=^ M \= Comp(Pi U P 2 ) U LF(Pi U P 2 ) 

^ Comp(P 1 ) U Comp(P 2 ) U LF(Px) U LF(P 2 ) 

<^ M n At (Pi) h Comp(Pi) U LF(Pi) and 

M n At(P 2 ) |= Comp(P 2 ) U LF(P 2 ) 
<S=^> M n At (Pi) G SM(Pi) and M n At(P 2 ) G SM(P 2 ). 

It follows that SM(Pi U P 2 ) = SM(P X ) x SM(P 2 ). □ 



Proof of Theorem \4J!3\ 

Let Ci and C 2 be two classes of logic program modules such that C 2 C C\ , and the 
module theorem holds for modules in C 2 . Consider a translation function Tr : C\ — > 
C 2 such that Conditions 1-3 from Definition 14.271 are satisfied. Let Pi,P 2 G C\ be 
modules such that PiUP 2 is defined. Then Condition 2 implies that Tr(Pi), Tr(P 2 ) G 
C 2 are modules such that Tr(Pi)UTr(P 2 ) is defined. Since the module theorem holds 
for modules in C 2 , SM(Tr(Pi) UTr(P 2 )) = SM(Tr(P 1 )) n SM(Tr(P 2 )). Moreover, 
Condition 3 implies that SM(Tr(Pi U P 2 )) = SM(Tr(Pi) U Tr(P 2 )). 
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Condition 1 implies there is a bijection 

g : SM(Pi U P 2 ) -> SM(Tr(Pi U P 2 )) 

such that for any M G SM(Pi U P 2 ) we have M = g(M) n At (Pi U P 2 ). Notice that 
strong faithfulness requires that the projections of M and <jr(M) have to be identical 
over whole At (Pi U P 2 ) not just over At v (Pi U P 2 ). Similarly there are bijections 

9l : SM(Pi) -> SM(Tr(Pi)) and 
g 2 : SM(P 2 ) -» SM(Tr(P 2 )) 

such that for any M, G SM(P. t ) (« = 1,2) it holds that M, = gi(Mi) n At(P,). 
Consider arbitrary M C At (Pi UP 2 ), and its projections Mi = M n At (Pi) and 
M 2 = M H At(P 2 ). Now, Mi and M 2 are compatible, and M = Mi U M 2 . 

Assume that M G SM(Pi UP 2 ). Since the module theorem holds for C 2 , we have 

g(M) G SM(Tr(Pi U P 2 )) = SM(Tr(Pi) U Tr(P 2 )) = SM(Tr(Pi)) * SM(Tr(P 2 )), 

that is, 

ATj = 9 (M) n At(Tr(Pi)) G SM(Tr(Pi)), 

N 2 = g(M) R At(Tr(P 2 )) G SM(Tr(P 2 )), and 

Ai and A 2 are compatible projections of g(M). Moreover, M = g(M) D At (Pi UP 2 ) 
and Mi = A, n At(Pj) for ? = 1,2. Using the inverse functions of <?i and g 2 we get 
Mi = gi l (Ni) G SM(Pi) and M 2 = g 2 _1 (A 2 ) G SM(P 2 ). 

For the other direction, assume that Mi G SM(Pi) and M 2 G SM(P 2 ). Then 
Ni = ,9i (Mi) G SM(Tr(Pi)) and A 2 = g 2 (M 2 ) G SM(Tr(P 2 )). Since 

Ni n At v (Tr (Pa)) = Mi n At v (P 2 ) , 

A 2 n At v (Tr (Pi ) ) = M 2 n At v (Pi) , and 

Mi and M 2 are compatible, also Ni and A 2 are compatible. By applying the module 
theorem for C 2 , we get N = Ni U A 2 G SM(Tr(Pi) U Tr(P 2 )) = SM(Tr(Pi U P 2 )). 
Furthermore, N n At (Pi U P 2 ) = Mi U M 2 = M, and using the inverse of g we get 
M = g~ l {N) G SM(Pi UP 2 ). 

Thus we have shown SM(P X U P 2 ) = SM(P X ) M SM(P 2 ). □ 

Proof of Theorem\4J(% 

Consider SMODELS program modules Pi and P 2 . It is straightforward to see that 
Tr N LP is U-preserving, that is, if P X UP 2 is defined, then also Tr N Lp(Pi)UTr N Lp(P2) 
is defined. The key observation is that for every edge in the dependency graph 
Dep+(Tr N Lp(Pi) U Tr N Lp(P2)) there is also an edge in Dep+(Pi U P 2 )0 Since Pi 
and P 2 are mutually independent, also TrNLp(Pi) and TrNLp(P2) are mutually 
independent. Furthermore, if Pi U P 2 is defined, then TrNLp(Pi) and TrNLp(P2) 
respect each other's hidden atoms. This is because new atoms are introduced only 

10 It might be the case that Dep+(Pi UP2) contains some edges that are not in Dep + (TrNLpQPi) U 
Ttnlp^))- This happens when there is a weight rule the body of which can never be satisfied. 
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for Choices(Pi) C At D (Pi) U At h (Pi) and Choices(P 2 ) C At Q (P 2 ) U At h (P 2 ), and 
(At (Pi) U At h (Pi)) n (At (Pa) U At h (P 2 )) = 0. Since 

IWOPi) U Tr NLP (P 2 ) = TW(P! U P a ) 

holds, Tr NLP is also modular. Thus Tr NL p satisfies conditions 2 and 3 in Defini- 
tion S271 

We are left to show that 

reveal(P,P) = m reveal(Tr NLP (P), H) 

for any SMODELS program module P = (P, I, O, H) and its translation Ttnlp(P) = 
(R,I,0,Hl)H'). Note that SM(P) = SM(reveal(P, H)) and SM(Tr NLP (P)) = 
SM(reveal(TrNLp(P), H)), and the additional restriction imposed by revealing is 
that the bijection between these sets of stable models needs to be such that their 
projections over At(P), not just over At v (P), coincide. 
We define a function / : SM(P) -> 2 At < TrNLp ( p » such that 

f(M) = M U {3 | a G Choices(P) \ M}. 

Clearly M = f(M) n At(P). We need to show that 

given any M G SM(P), /(A/) G SM(Tr NL p(P)); and 
/ : SM(P) -» SM(Tr NL p(P)) is a bijection. 

Note that for any atom a G Choices(P), it holds that a G f(M ) if and only if a ^ M 
if and only if a £ f(M). 

We show that A = f(M) G SM(Tr NL p(P)) for any M G SM(P): 

Assume first A \£ R N I , that is, there is a rule r in R 1 *' 1 that is not satisfied by A. 

If Hcad(r) G At(P), then r is of the form a <— B' \I and there are two possibilities: 

1. There is a rule a <— B' , ~C, ~a G R corresponding to a choice rule {A} <— 
B',~C G P such that a G A, 3 A, B' nl C A, andCnJV = 0. Since 3 £ A 
implies a G A, r is satisfied in A, a contradiction. 

2. There is a rule a <— P/,~C" G i? corresponding to a weight rule r' = 
a <- io < {P = W B ,~C = W c } G P such that B' C B, C C C, w < 
HbeB' w b + Y,cec w c, B' (1 I C A, and C'nJV = 0. Since A ^ r we 
must have a £ A (which implies a g M) and B' \ I C N, Thus B' C N 
which implies P' C M. Moreover, C" n A = implies C n M = 0. But 
then w < X^fcgB'nM w b + ScGC\Af w c- Since P' C P and C" C C, we have 
w — ShesnM w fc + 12cec\M w c and M ^= r', a contradiction. 

Otherwise each r G P^ is of the form 3, in which case there is a rule 3 <— G P 
and a ^ A. Since a ^ A implies 3 G A, then A |= r, a contradiction. Thus 
A |= fl*- 7 , and furthermore A \ 7 |= R N ' T . 

Assume now A\J ^ LM(R N > r ), that is, there is A' C N\I such that A' \= R N >*. 
We define M' = A'nAt(P) and show M' (= P M,/ , which contradicts the assumption 
M\I = LM(P M ' / ), since M' C M \ J. Assume that there is a rule r G P M,/ such 
that M' y= r. There are two possibilities: 
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1. r is of the form a <— B \ I. Then there is a choice rule {A} <— B, G P, 
such that Bfl/C M, C f) M = 0, and aeMnA. Now, P n 7 C M implies 
P n 7 C TV, C n M = implies C n TV = 0, and a G M implies a G TV 
and a ^ TV. Together with {A} <- P, ~C G P these imply r G P^' 7 . Since 
M' ^ r, we have a £ M' and B \ I C M'. But, since TV' n At(P) = M', this 
implies TV' Y= r, a contradiction to TV' |= R N I . 

2. r is of the form a <— «/ < {P \ 7 = W^w}. Then there is a weight rule 
a <- to < {P = Wfl, = W c } G P such that 

w' = max(0,w— Wb — io c ). 

iefin/nM cec\M 

Since M' ^ r, we have a G' M' and w' < Ete(B\/)nM' Wb - Define B' = 
(Pn/nM)U((P\7)nM') and C" = C\M, and recall that TV'nAt(P) = M' . 
Now w < J2 beB > w b + Ecec w <=, C" n TV = 0, P' n 7 C TV, P' \ I C TV' and 
a ^ TV', which implies that there is a rule r' = a <— P' \ 7 G P^' 7 such that 
TV' ^ r' which is in contradiction with TV' (= R N ' ! . 

Thus assuming that there is TV' C TV \ 7 such that TV' |= R N I leads to a contradic- 
tion, and it holds that TV \ I = LM(P JV ' / ), that is, TV G SM(Tr NLP (P)). 
We show that f : SM(P) -> SM(Tr NLP (P)) is a bijection: 

Clearly / is an injection: M ^ M' implies /(M) ^ /(M'). To show that / is a 
surjection, we consider an arbitrary TV G SM(TrNLp(P)) and show TV n At(P) = 
M £ SM(P) and f(M) = /(TV n At(P)) = TV. 

— Assume first M Y= P M,/ , that is, there is a rule r G P M ' 7 that is not satisfied. 
Notice that all the rules in P M < 7 corresponding to a choice rule in P are 
always satisfied in M . Thus we need to consider only rules that correspond 
to a weight rule in P. Now, r = a <- w' < {B\I = W BXI } £ P MJ , if 
there is a weight rule a <— w < {P = Wb,~C = Wc} G P such that w' = 
max(0,w-X; 6eBnMnJ w 6 -X; ceC y M io c ). Since M ^ r, then a^M and io' < 
T,be(B\i)nM w b- Define B' = BC\M and C" = C \ M. Since TV n At(P) = M 
and w < ^ beB / Wb + Ecec Wc > there is a normal rule a <— B',~C G P. 
Furthermore, C" n TV = and P' n I C TV imply r' = a <- B' \ I G P^' 7 . 
Since a^M, also a £ TV. Furthermore, B'\I C M C TV. These imply TV ^ r' 
which leads to a contradiction. Thus M |= r, and moreover M |= P M ' 7 . 
- Next, assume that there is M' C M \ I such that M' |= P M < 7 and define 
TV' = TIP U (TV \ At(P)) C TV \ 7. Since TV' \ At(P) = TV \ At(P) by definition, 
each rule of the form a G P^' 7 is satisfied in TV'. Other rules in R N I are of 
the form r = a <— P' \ 7 where a G At(P). There are now two possibilities. 

1. There is a choice rule {A} <- P', ~C g P, such that a G A, P' n 7 C TV, 
C n TV = 0, and a £ TV. Now, M n At(P) = TV n At(P) implies r G P MJ , 
and furthermore, M' |= P M ' 7 implies M 1 \= r. Recalling M' n At(P) = 
TV'n At(P), we get TV' |= r. 

2. There is a rule a <— P', ~C" G P corresponding to a weight rule a <— w < 
{P = VK B , ~C = Wc} G P such that B' C P, C" C C, to < £ beB , w b + 
E cec , w c , P' n 7 C TV and C" n TV = 0. If P' \ 7 g TV', then TV' |= r. 
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Assume that B' \ I C N'. It follows from B' C B and C" C C that 

w < ^ w 6 + ^2 w b + ^2 w c . 

be(B\i)nN' beBniriN cec\N 

Since M n At(P) = AT n At(P), there is r' = a <- w' < {B \ I = W B \i] G 
P MJ such that w' = max(0, to - Efcesn/nM w & + E ce c\M Further- 
more, w' < Ete(B\/)nM' w fc = Ebe(s\j)nJV' w &- Since M ' 1= r '> we have 
a e M', and also a £ A 7 . Thus AT' (= r. 

Thus using the assumption M\I ^ LM(P M ^) we can show that there is 
AT' C N\I such that AT' |= i?^' 7 , which leads to a contradiction with N\I = 
LM(R NI ). Therefore, M\I = LM(P M,/ ). 
— Finally, we show that f(M) = f(N n At(P)) = N. Let AT' = /(M), that is, 

N' = M U {a | a £ Choices(P) \ M}. 

Notice that N n At(P) = N' n At(P) = M. Assume A g Af', that is, there 
isa £ JV such that a £ N' . Since a N' , we have a € AT' and furthermore 
a E N. The only rule r in i? such that a = Head(r) is a <— ~a. However, 
if a £ JV, there is no rule in R N ' ! in which a appears in the head. Because 
N \ I is the least model of R N ' ! , we have a A ', a contradiction. Assume 
then A' % N, that is, there is a £ AT' such that a £ N. Since a £ A', we have 
a <£ N' and furthermore a £ N. If a N, then a £ i?^' 7 . Since AT \ I \= R N I , 
we must have a E N, & contradiction. Therefore it holds that A = N'. 

Thus we have shown that TrNLP is a strongly faithful, U-preserving, and modular 
translation function. □ 
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